CVE-2023-0010 — Cross-site Scripting in Palo Alto Networks Pan-os

CWE-79 — Cross-site ScriptingCWE-476 — NULL Pointer DereferenceCWE-909 — Missing Initialization of ResourceCWE-367 — Time-of-check Time-of-use (TOCTOU) Race ConditionCWE-1341 — Multiple Releases of Same Resource or HandleCWE-825 — Expired Pointer Dereference42 documents8 sources
Severity
5.4MEDIUMNVD
EPSS
0.8%
top 25.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Palo Alto Networks Pan-osPaloaltonetworks Pan-osPaloalto Cloud Ngfw+2 more
Timeline
PublishedJun 14
Latest updateDec 30

Description

A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages5 packages

▶CVEListV5palo_alto_networks/pan-os10.2 — 10.2.2+5
▶NVDpaloaltonetworks/pan-os8.1.0 — 8.1.24+5
▶Palo Altopaloalto/pan-os

🔴Vulnerability Details

5
OSV
quota: fix warning in dqgrab()↗2025-12-30
▶
OSV
iommufd: Check for uptr overflow↗2025-12-30
▶
OSV
net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()↗2025-12-24
▶
GHSA
GHSA-p7xj-vgvg-jrrq: A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payloa↗2023-06-14
▶
CVEList
PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication↗2023-06-14
▶

📋Vendor Advisories

7
Red Hat
kernel: scsi: target: iscsit: Free cmds before session free↗2025-12-30
▶
Red Hat
kernel: bpf: Zeroing allocated object from slab in bpf memory allocator↗2025-12-09
▶
Red Hat
kernel: hfs: fix missing hfs_bnode_get() in __hfs_bnode_create↗2025-12-09
▶
Red Hat
kernel: firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle↗2025-09-15
▶
Red Hat
kernel: scsi: qla2xxx: Synchronize the IOCB count to be in order↗2025-05-02
▶
CVE-2023-0010 — Cross-site Scripting in Palo | cvebase