CVE-2021-3052 — Cross-site Scripting in Palo Alto Networks Pan-os

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
5.4MEDIUMNVD
CNA8.0
EPSS
0.6%
top 29.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Palo Alto Networks Pan-osPaloaltonetworks Pan-osPaloalto Pan-os
Timeline
PublishedSep 8
Latest updateMay 24

Description

A reflected cross-site scripting (XSS) vulnerability in the Palo Alto Network PAN-OS web interface enables an authenticated network-based attacker to mislead another authenticated PAN-OS administrator to click on a specially crafted link that performs arbitrary actions in the PAN-OS web interface as the targeted authenticated administrator. This issue impacts: PAN-OS 8.1 versions earlier than 8.1.20; PAN-OS 9.0 versions earlier than 9.0.14; PAN-OS 9.1 versions earlier than 9.1.10; PAN-OS 10.0 ve…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶NVDpaloaltonetworks/pan-os8.1.0 — 8.1.20+3
▶CVEListV5palo_alto_networks/pan-os9.0 — 9.0.14+3
▶Palo Altopaloalto/pan-os

🔴Vulnerability Details

2
GHSA
GHSA-xx6w-2mwc-44g2: A reflected cross-site scripting (XSS) vulnerability in the Palo Alto Network PAN-OS web interface enables an authenticated network-based attacker to↗2022-05-24
▶
CVEList
PAN-OS: Reflected Cross-Site Scripting (XSS) in Web Interface↗2021-09-08
▶

📋Vendor Advisories

1
Palo Alto
PAN-OS: Reflected Cross-Site Scripting (XSS) in Web Interface↗2021-09-08
▶
CVE-2021-3052 — Cross-site Scripting in Palo | cvebase