Last revised: 06/28/2018
A Cross-Site Scripting (XSS) vulnerability exists in a PAN-OS web interface administration page. (Ref. # PAN-93242; CVE-2018-9337)
Successful exploitation of this issue may allow an attacker to inject arbitrary JavaScript or HTML An attacker would need to successfully authenticate prior to exploiting this issue.
PAN-OS 6.1.20 and earlier, PAN-OS 7.1.17 and earlier, PAN-OS 8.0.10 and earlier, and PAN-OS 8.1.1 and earlier
PAN-OS 6.1.21 and later, PAN-OS 7.1.18 and later, PAN-OS 8.0.11-h1 and later, and PAN-OS 8.1.2 and later
This issue affects the web-based management interface of PAN-OS and is strongly mitigated by following best practices for securing the PAN-OS management interface. Our best practices guidelines reduce the exposure of the management interface to potential attackers. Please review the Best Practices for Securing Administrative Access in the PAN-OS 8.1 technical documentation, available at:https://www.paloaltonetworks.com/documentation/81/pan-os/pan-os/getting-started/best-practices-for-securing-administrative-access.
Palo Alto Networks would like to thank Davide 'Peru' Peruzzi - GoSecure! for reporting this issue.