CVE-2023-0010Medium

CVE-2023-0010 PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication

Published
June 14, 2023
Last Modified
June 29, 2023

🔗 CVE IDs covered (1)

CVE-2023-0010 →

📋 Description

A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.

🎯 Affected products3

  • PAN-OS
  • Prisma Access
  • Cloud NGFW

✅ Remediation

This issue is fixed in PAN-OS 8.1.24, PAN-OS 9.0.17, PAN-OS 9.1.16, PAN-OS 10.0.11, PAN-OS 10.1.6, PAN-OS 10.2.2, and all later PAN-OS versions. Workarounds and mitigations: Customers with a Threat Prevention subscription can block attacks for this vulnerability by enabling Threat ID 92065 (Applications and Threats content update 8722).

🔗 References (1)