PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
Published Dec 13, 2023
4.8
MEDIUMCVSS 3.1
EPSS 0.41%
Description
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. Then, when viewed by a properly authenticated administrator, the JavaScript payload executes and disguises all associated actions as performed by that unsuspecting authenticated administrator.
Affected products
-
- Version 10.0StatusaffectedConstraints<=All
- Version 10.1StatusaffectedConstraints<10.1.11
- Version 10.2StatusaffectedConstraints<10.2.5
- Version 11.0StatusaffectedConstraints<11.0.2
- Version 8.1StatusaffectedConstraints<8.1.26
- Version 9.0StatusaffectedConstraints<9.0.17-h4
- Version 9.1StatusaffectedConstraints<9.1.17
- Version 11.1StatusunaffectedConstraints<All
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Palo Alto Networks | Pan-OS | unaffected |
|
- ≥ 8.1.0 · < 8.1.26
- ≥ 9.0.0 · < 9.0.17
- ≥ 9.1.0 · < 9.1.17
- ≥ 10.1.0 · < 10.1.11
- ≥ 10.2.0 · < 10.2.5
- ≥ 11.0.0 · < 11.0.2
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
This issue is fixed in PAN-OS 8.1.26, PAN-OS 9.0.17-h4, PAN-OS 9.1.17, PAN-OS 10.1.11, PAN-OS 10.2.5, PAN-OS 11.0.2, and all later PAN-OS versions.
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-59000 Advisory
- https://security.paloaltonetworks.com/CVE-2023-6789 Vendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-59000 | Advisory | |
| https://security.paloaltonetworks.com/CVE-2023-6789 | Vendor Advisory |
Change history (0)
No recorded changes yet.