CVE-2023-0007
Assigner: palo_alto
Published: 2023-05-10T16:30:47.049Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: Panorama
product: PAN-OS
vendor: Palo Alto Networks
versions: changes: at: 10.0.7
status: unaffected
lessThan: 10.0.7
status: affected
version: 10.0
versionType: custom
changes: at: 9.1.16
status: unaffected
lessThan: 9.1.16
status: affected
version: 9.1
versionType: custom
changes: at: 9.0.17
status: unaffected
lessThan: 9.0.17
status: affected
version: 9.0
versionType: custom
changes: at: 8.1.25
status: unaffected
lessThan: 8.1.25
status: affected
version: 8.1
versionType: custom
status: unaffected
version: 10.1
status: unaffected
version: 10.2
status: unaffected
version: 11.0
defaultStatus: unaffected
product: Prisma Access
vendor: Palo Alto Networks
versions: status: unaffected
version: All
defaultStatus: unaffected
product: Cloud NGFW
vendor: Palo Alto Networks
versions: status: unaffected
version: All
credits: type: finder
value: Colin McQueen
datePublic: 2023-05-10T16:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <span style="background-color: rgb(255, 255, 255);">A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administrator’s browser when viewed.</span><br>
value: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administrator’s browser when viewed.

exploits: supportingMedia: base64: no
type: text/html
value: <p>Palo Alto Networks is not aware of any malicious exploitation of this issue.</p>
value: Palo Alto Networks is not aware of any malicious exploitation of this issue.


impacts: capecId: CAPEC-592
descriptions: value: CAPEC-592 Stored XSS
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-80
description:  CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: <span style="background-color: rgb(255, 255, 255);">This issue is fixed in PAN-OS 8.1.25, PAN-OS 9.0.17, PAN-OS 9.1.16, PAN-OS 10.0.7, and all later PAN-OS versions.</span><br>
value: This issue is fixed in PAN-OS 8.1.25, PAN-OS 9.0.17, PAN-OS 9.1.16, PAN-OS 10.0.7, and all later PAN-OS versions.

source: defect: PAN-166872
discovery: EXTERNAL
timeline: time: 2023-05-10T16:00:00.000Z
value: Initial publication
title: PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface
workarounds: supportingMedia: base64: no
type: text/html
value: <span style="background-color: rgb(255, 255, 255);">This issue requires the attacker to have authenticated access to the PAN-OS web interface. You can mitigate the impact of this issue by following best practices for securing the PAN-OS web interface. Please review the Best Practices for Securing Administrative Access in the PAN-OS technical documentation at </span><a target="_blank" rel="nofollow" href="https://docs.paloaltonetworks.com/best-practices">https://docs.paloaltonetworks.com/best-practices</a><span style="background-color: rgb(255, 255, 255);">.</span><br>
value: This issue requires the attacker to have authenticated access to the PAN-OS web interface. You can mitigate the impact of this issue by following best practices for securing the PAN-OS web interface. Please review the Best Practices for Securing Administrative Access in the PAN-OS technical documentation at  https://docs.paloaltonetworks.com/best-practices https://docs.paloaltonetworks.com/best-practices .

x_generator: engine: Vulnogram 0.1.0-dev