CVE-2019-1565 - The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacker that is authenticated in Next Generation Firewall with write privileges to External Dynamic List configuration to inject arbitrary JavaScript or HTML

Back Back to CVE browser

MEDIUM

The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacker that is authenticated in Next Generation Firewall with write privileges to External Dynamic List configuration to inject arbitrary JavaScript or HTML

Published Jan 30, 2019

5.4

MEDIUM

CVSS 3.0

EPSS 0.67%

Description

The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacker that is authenticated in Next Generation Firewall with write privileges to External Dynamic List configuration to inject arbitrary JavaScript or HTML.

Affected products

Vendor Palo Alto Networks Product Palo Alto Networks PAN-OS Default
n/a
- Version
  PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier.
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Palo Alto Networks

Palo Alto Networks PAN-OS

n/a

Version	Status	Constraints
PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier.	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

http://www.securityfocus.com/bid/106752
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://security.paloaltonetworks.com/CVE-2019-1565
x_refsource_CONFIRM

Link	Providers	Tags
http://www.securityfocus.com/bid/106752		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://security.paloaltonetworks.com/CVE-2019-1565		x_refsource_CONFIRM