Security readout for executives and security teams
Plain-English summary
This PAN-OS flaw lets a highly privileged administrator read local system files by committing a specially crafted configuration. It requires existing admin access with commit rights, so the main business risk is misuse or compromise of privileged firewall administrator accounts, not broad unauthenticated internet exploitation.
Executive priority
Treat this as a moderate-priority firewall governance issue. It is not described as actively exploited, but it can expose sensitive local files if a privileged PAN-OS administrator account is misused or compromised.
Technical view
CVE-2023-38046 affects Palo Alto Networks PAN-OS and is classified as CWE-610. The CVSS 3.1 score is 5.5 with network access, low complexity, high privileges required, no user interaction, high confidentiality impact, low integrity impact, and no availability impact.
Likely exposure
Exposure is limited to PAN-OS deployments on listed major versions 11.0, 10.2, 10.1, 10.0, 9.1, 9.0, and 8.1 where administrators can commit configurations. The source bundle states Cloud NGFW and Prisma Access are unaffected.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. Exploitation requires an authenticated administrator with commit privileges and a specifically created configuration, making privileged-account compromise or insider misuse the most relevant scenario.
Researcher notes
Evidence is strongest for the access prerequisites, impact profile, and affected product scope. The source bundle does not provide exploit details, observed exploitation, or specific fixed versions, so remediation should be tied directly to Palo Alto Networks guidance.
Mitigation direction
- Check Palo Alto Networks advisory for affected and fixed PAN-OS release guidance.
- Prioritize remediation for firewalls with many administrators or weaker admin access controls.
- Restrict configuration commit privileges to trusted administrators until remediation is confirmed.
- Review administrator accounts and remove unnecessary commit permissions.
- Monitor configuration commits for unusual timing, authors, or unexplained changes.
Validation and detection
- Inventory PAN-OS versions across firewalls and management platforms.
- Flag systems running listed affected PAN-OS major versions.
- Confirm Cloud NGFW and Prisma Access assets are excluded from this CVE scope.
- Review which administrators can commit configurations.
- Check configuration commit logs for unexpected privileged activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-610: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-38046 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N1.24.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://security.paloaltonetworks.com/CVE-2023-38046CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Externally Controlled Reference to a Resource in Another Sphere
Externally Controlled Reference to a Resource in Another Sphere represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.