CVE-2023-6790 - PAN-OS: DOM-Based Cross-Site Scripting (XSS) Vulnerability in the Web Interface

Back Back to CVE browser

HIGH

PAN-OS: DOM-Based Cross-Site Scripting (XSS) Vulnerability in the Web Interface

Published Dec 13, 2023

8.8

HIGH

CVSS 3.1

EPSS 0.66%

Description

A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the context of an administrator’s browser when they view a specifically crafted link to the PAN-OS web interface.

Affected products

Vendor Palo Alto Networks Product Pan-OS Default
unaffected
Affected
- ≥ 10.0, < 10.0.12
- ≥ 10.1, < 10.1.9
- ≥ 10.2, < 10.2.4
- ≥ 11.0, < 11.0.1
- ≥ 8.1, < 8.1.25
- ≥ 9.0, < 9.0.17
- ≥ 9.1, < 9.1.16
Unaffected
- ≥ 11.1, < All

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Palo Alto Networks	Pan-OS	unaffected	Affected ≥ 10.0, < 10.0.12 ≥ 10.1, < 10.1.9 ≥ 10.2, < 10.2.4 ≥ 11.0, < 11.0.1 ≥ 8.1, < 8.1.25 ≥ 9.0, < 9.0.17 ≥ 9.1, < 9.1.16 Unaffected ≥ 11.1, < All

Remediation

Vendor solution

This issue is fixed in PAN-OS 8.1.25, PAN-OS 9.0.17, PAN-OS 9.1.16, PAN-OS 10.0.12, PAN-OS 10.1.9, PAN-OS 10.2.4, PAN-OS 11.0.1, and all later PAN-OS versions.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)