← Back

CVE-2024-0007

nvd nist
Published: Feb 14, 2024Modified: Dec 17, 2024

JSON object

Loading...
4.8
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Exploitability: 1.7 / Impact: 2.7
Source: NVD

Description

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface on Panorama appliances. This enables the impersonation of another authenticated administrator.

Affected (6)

Paloaltonetworks
1 product
Pan Os
Configuration A
6 vulnerable · 3 platform
Vulnerable SoftwareAffected Versions
Paloaltonetworks
Pan Os
From 10.0.0 to 10.0.11
Pan Os
From 10.1.0 to 10.1.6
Pan Os
From 8.1.0 to 8.1.24
Pan Os
From 9.0.0 to 9.0.17
Pan Os
From 9.1.0 to 9.1.16
Pan Os
Version 8.1.24
Running on/withPlatform Versions
Paloaltonetworks
Panorama M 200
All versions
Paloaltonetworks
Panorama M 500
All versions
Paloaltonetworks
Panorama M 600
All versions

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

Source: psirt@paloaltonetworks.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.