What is CVE-2019-1578?

CVE-2019-1578 is a security advisory published by Palo Alto Networks Security Advisories with Medium severity. CVE-2019-1578 Cross Site Scripting (XSS) in MineMeld

Which CVE IDs does CVE-2019-1578 cover?

CVE-2019-1578 covers the following CVE IDs: CVE-2019-1578. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by CVE-2019-1578?

CVE-2019-1578 affects 1 product, including: MineMeld.

CVE-2019-1578Medium

CVE-2019-1578 Cross Site Scripting (XSS) in MineMeld

Vendor

Palo Alto Networks Security Advisories

Published

June 27, 2019

Last Modified

June 27, 2019

🔗 CVE IDs covered (1)

CVE-2019-1578 →

📋 Description

A reflected cross-site scripting (XSS) vulnerability exists in Palo Alto Networks MineMeld. (Ref CVE-2019-1578) A remote attacker able to convince an authenticated MineMeld admin to type malicious input in the MineMeld UI could execute arbitrary JavaScript code in the admin’s browser. This issue affects Open Source Community Supported MineMeld version 0.9.60 and earlier. AutoFocus-Hosted MineMeld is NOT affected.

🎯 Affected products1

MineMeld

✅ Remediation

Open Source Community Supported MineMeld version 0.9.62. Workarounds and mitigations: Users of affected versions who can’t upgrade to 0.9.62 or later should set the environment variable DISABLE_NEW_EXTENSIONS=1 in MineMeld service startup to prevent the execution of the vulnerable code.

🔗 References (1)

advisoryhttps://security.paloaltonetworks.com/CVE-2019-1578