CVE-2019-1565 — Cross-site Scripting in Paloaltonetworks Pan-os

CWE-79 — Cross-site Scripting6 documents6 sources
Severity
5.4MEDIUMNVD
EPSS
0.3%
top 44.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Paloaltonetworks Pan-osPalo Alto Networks Pan-osPaloalto Pan-os
Timeline
PublishedJan 30
Latest updateMay 13

Description

The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacker that is authenticated in Next Generation Firewall with write privileges to External Dynamic List configuration to inject arbitrary JavaScript or HTML.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶NVDpaloaltonetworks/pan-os7.1.22 — 8.0.14+2
▶Palo Altopaloalto/pan-os
▶CVEListV5palo_alto_networks/palo_alto_networks_pan-osPAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier.

🔴Vulnerability Details

2
GHSA
GHSA-mrjc-729g-rfq4: The PAN-OS external dynamics lists in PAN-OS 7↗2022-05-13
▶
CVEList
CVE-2019-1565: The PAN-OS external dynamics lists in PAN-OS 7↗2019-01-30
▶

💥Exploits & PoCs

1
Nuclei
D-Link Routers - Remote Code Execution
▶

📋Vendor Advisories

1
Palo Alto
Cross-Site Scripting (XSS) in PAN-OS External Dynamic Lists↗2019-01-23
▶
CVE-2019-1565 — Cross-site Scripting | cvebase