Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2021-3052

PAN-OS: Reflected Cross-Site Scripting (XSS) in Web Interface

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
palo_alto

Description

A reflected cross-site scripting (XSS) vulnerability in the Palo Alto Network PAN-OS web interface enables an authenticated network-based attacker to mislead another authenticated PAN-OS administrator to click on a specially crafted link that performs arbitrary actions in the PAN-OS web interface as the targeted authenticated administrator. This issue impacts: PAN-OS 8.1 versions earlier than 8.1.20; PAN-OS 9.0 versions earlier than 9.0.14; PAN-OS 9.1 versions earlier than 9.1.10; PAN-OS 10.0 versions earlier than 10.0.2. This issue does not affect Prisma Access.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palo Alto Networks PAN-OS

  • 10.1.*unaffected
  • 9.0 to < 9.0.14affected
  • 8.1 to < 8.1.20affected
  • 9.1 to < 9.1.10affected
  • 10.0 to < 10.0.2affected

References