Lucene search

Palo Alto Networks Product Security Incident Response TeamPAN-SA-2018-0014

HistoryOct 12, 2018 - 2:35 a.m.

Cross-Site Scripting (XSS) in GlobalProtect Portal Login Page

2018-10-1202:35:00

Palo Alto Networks Product Security Incident Response Team

securityadvisories.paloaltonetworks.com

750

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

47.7%

JSON

A Cross-Site Scripting (XSS) vulnerability exists in the PAN-OS GlobalProtect Portal Login page. (Ref. # PAN-99830; CVE-2018-10141)
Successful exploitation of this issue may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML.
This issue affects PAN-OS 8.1.3 and earlier. PAN-OS 8.0, PAN-OS 7.1 and PAN-OS 6.1 are NOT affected.

Work around:
Customers not using GlobalProtect feature of PAN-OS are not impacted by this vulnerability.

CPENameOperatorVersion
pan-osle8.1.3

CPE	Name	Operator	Version
	pan-os	le	8.1.3

References

security.paloaltonetworks.com/CVE-2018-10141

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

47.7%

JSON

Related for PAN-SA-2018-0014