Lucene search

Palo Alto Networks Product Security Incident Response TeamPAN-SA-2017-0011

HistoryApr 20, 2017 - 6:00 p.m.

Cross-Site Scripting in PAN-OS

2017-04-2018:00:01

Palo Alto Networks Product Security Incident Response Team

securityadvisories.paloaltonetworks.com

575

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

45.1%

JSON

A vulnerability exists in the PAN-OS GlobalProtect external interface that could allow for a cross-site scripting (XSS) attack. PAN-OS does not properly validate specific request parameters. (Ref # PAN-70674 / CVE-2017-7409)
Successful exploitation of this issue may allow an attacker to inject arbitrary Javascript or HTML.
This issue affects PAN-OS 7.0.14 and earlier

Work around:
Customers that have not configured GlobalProtect are not affected by this issue.

CPENameOperatorVersion
pan-osle7.0.14

CPE	Name	Operator	Version
	pan-os	le	7.0.14

References

security.paloaltonetworks.com/CVE-2017-7409

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

45.1%

JSON

Related for PAN-SA-2017-0011