Lucene search

Palo Alto Networks Product Security Incident Response TeamPAN-SA-2017-0030

HistoryJan 02, 2018 - 6:09 p.m.

Cross Site Scripting Vulnerability in PAN-OS GlobalProtect

2018-01-0218:09:00

Palo Alto Networks Product Security Incident Response Team

securityadvisories.paloaltonetworks.com

580

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

43.6%

JSON

A vulnerability exists in PAN-OS GlobalProtect when either the gateway or the portal are configured. This issue could allow for a cross-site scripting (XSS) attack. (Ref # PAN-81586 / CVE-2017-15941)
Successful exploitation of this issue may allow an attacker to inject arbitrary javascript or HTML.
This issue affects PAN-OS 6.1.18 and earlier, PAN-OS 7.0.18 and earlier, PAN-OS 7.1.13 and earlier, PAN-OS 8.0.6-h3 and earlier.

Work around:
Customers not using PAN-OS GlobalProtect portal or gateway are not impacted by this vulnerability.

References

security.paloaltonetworks.com/CVE-2017-15941

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

43.6%

JSON

Related for PAN-SA-2017-0030