CVE-2024-5920 — Cross-site Scripting in Palo Alto Networks Pan-os

CWE-79 — Cross-site Scripting4 documents4 sources

Severity

4.6MEDIUMNVD

EPSS

0.6%

top 30.95%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Palo Alto Networks Pan-os Paloaltonetworks Pan-os Paloalto Cloud Ngfw +2 more

Timeline

PublishedNov 14

Description

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a specially crafted configuration to a PAN-OS node. This enables impersonation of a legitimate PAN-OS administrator who can perform restricted actions on the PAN-OS node after the execution of JavaScript in the legitimate PAN-OS administrator's browser.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages5 packages

▶NVDpaloaltonetworks/pan-os10.1.0 — 10.1.14+3

▶CVEListV5palo_alto_networks/pan-os11.1.0 — 11.1.4+3

▶Palo Altopaloalto/pan-os

▶Palo Altopaloalto/cloud_ngfw

▶Palo Altopaloalto/prisma_access

🔴Vulnerability Details

GHSA

GHSA-xx8r-3wgj-j632: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a↗2024-11-14

▶

CVEList

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator↗2024-11-14

▶

📋Vendor Advisories

Palo Alto

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator↗

▶