Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2023-0010

PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
palo_alto

Description

A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palo Alto Networks PAN-OS

Default version status: unaffected

  • 11.0unaffected
  • 10.2 to < 10.2.2affected
  • 10.1 to < 10.1.6affected
  • 10.0 to < 10.0.11affected
  • 9.1 to < 9.1.16affected
  • 9.0 to < 9.0.17affected
  • 8.1 to < 8.1.24affected

Palo Alto Networks Cloud NGFW

Default version status: unaffected

  • Allunaffected

Palo Alto Networks Prisma Access

Default version status: unaffected

  • Allunaffected

References