Lucene search

Palo Alto Networks Product Security Incident Response TeamPAN-SA-2013-0002

HistoryJul 22, 2013 - 7:00 a.m.

Cross-site Scripting Vulnerability

2013-07-2207:00:00

Palo Alto Networks Product Security Incident Response Team

securityadvisories.paloaltonetworks.com

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.001

Percentile

47.1%

JSON

A cross-site scripting vulnerability exists in the web-based device management API browser whereby data provided by the user is echoed back to the user without sanitization. (Ref #50908)
This issue affects the management interface of the device where the API browser is exposed.
This issue affects PAN-OS version 4.1.12 and earlier; 5.0.5 and earlier.

Work around:
This issue only affects the web-based device management API browser.

Affected configurations

Vulners

Node

softwarepan-osRange≤4.1.12

softwarepan-osRange≤5.0.5

VendorProductVersionCPE
softwarepan-os*cpe:2.3:a:software:pan-os:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
software	pan-os	*	cpe:2.3:a:software:pan-os::::::::

References

security.paloaltonetworks.com/CVE-2013-5664

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.001

Percentile

47.1%

JSON

Related for PAN-SA-2013-0002