CVE-2024-0007

published 2024-02-14

CVE-2024-0007: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a…

Priority P4 19 medium 4.8 CVSS 3.1

AV N AC L PR H UI R S C C L I L A N

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface on Panorama appliances. This enables the impersonation of another authenticated administrator.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
palo_alto_networks	pan-os	>= 10.0 < 10.0.11	10.0.11
palo_alto_networks	pan-os	>= 10.1 < 10.1.6	10.1.6
palo_alto_networks	pan-os	>= 8.1 < 8.1.24-h1	8.1.24-h1
palo_alto_networks	pan-os	>= 8.1 < 8.1.25	8.1.25
palo_alto_networks	pan-os	>= 9.0 < 9.0.17	9.0.17
palo_alto_networks	pan-os	>= 9.1 < 9.1.16	9.1.16
paloalto	cloud_ngfw	—	—
paloalto	pan-os	—	—
paloalto	prisma_access	—	—
paloaltonetworks	pan-os	—	—
paloaltonetworks	pan-os	>= 10.0.0 < 10.0.11	10.0.11
paloaltonetworks	pan-os	>= 10.1.0 < 10.1.6	10.1.6
paloaltonetworks	pan-os	>= 8.1.0 < 8.1.24	8.1.24
paloaltonetworks	pan-os	>= 9.0.0 < 9.0.17	9.0.17
paloaltonetworks	pan-os	>= 9.1.0 < 9.1.16	9.1.16

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79