What is PAN-SA-2015-0003?

PAN-SA-2015-0003 is a security advisory published by Palo Alto Networks Security Advisories with Medium severity. PAN-SA-2015-0003 Cross-site Scripting Vulnerability

Why does PAN-SA-2015-0003 have no CVE ID yet?

Palo Alto Networks Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by PAN-SA-2015-0003?

PAN-SA-2015-0003 affects 1 product, including: PAN-OS.

PAN-SA-2015-0003MediumDisclosed before NVD

PAN-SA-2015-0003 Cross-site Scripting Vulnerability

Vendor

Palo Alto Networks Security Advisories

Published

May 14, 2015

Last Modified

May 14, 2015

📋 Description

A cross-site scripting vulnerability exists in the web-based device management interface whereby data provided by the user is echoed back to the user without sanitization. (Ref# 73638) This issue affects the management interface of the device, where an authenticated administrator may be tricked into injecting malicious javascript into the web UI interface. This issue affects PAN-OS 6.1.2 and earlier; PAN-OS 6.0.8 and earlier; PAN-OS 5.0.15 and earlier

🎯 Affected products1

PAN-OS

✅ Remediation

PAN-OS 6.1.3; PAN-OS 6.0.9; PAN-OS 5.0.16 Workarounds and mitigations: This issue affects the management interface of the device. Security appliance management best practices dictate that the management interface be isolated and strictly limited only to security administration personnel.

🔗 References (1)

advisoryhttps://security.paloaltonetworks.com/PAN-SA-2015-0003