CVE-2024-5920

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a specially crafted configuration to a PAN-OS node. This enables impersonation of a legitimate PAN-OS administrator who can perform restricted actions on the PAN-OS node after the execution of JavaScript in the legitimate PAN-OS administrator's browser.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Palo Alto Networks	Cloud NGFW	—
Palo Alto Networks	PAN-OS	>= 11.1.0, < 11.1.4; >= 11.0.0, < 11.0.6; >= 10.2.0, < 10.2.7-h24; >= 10.1.0, < 10.1.14
Palo Alto Networks	Prisma Access	—

References

https://security.paloaltonetworks.com/CVE-2024-5920Vendor Advisory

Timeline

Published: Nov 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-59218.8An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect ap CVE-2024-59226.4The Scylla lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode CVE-2024-59248.8Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-We CVE-2024-59256.4The Theron Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode CVE-2024-59269.1A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the CVE-2024-59287.8VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escala CVE-2024-59297.8VIPRE Advanced Security PMAgent Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local a CVE-2024-59307.8VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers CVE-2024-59316.5BT: Unchecked user input in bap_broadcast_assistant CVE-2024-59329.8The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and CVE-2024-59335.4A Cross-site Scripting (XSS) vulnerability exists in the chat functionality of parisneo/lollms-webui in the latest version. This vulnerabili CVE-2024-59355.4A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files o