Last revised: 08/31/2017
A vulnerability exists in PAN-OS’s GlobalProtect internal and external gateway interface. This issue could allow for a cross-site scripting (XSS) attack. PAN-OS does not properly validate specific request parameters. (Ref # PAN-76003 / CVE-2017-12416)
Successful exploitation of this issue may allow an attacker to inject arbitrary Java script or HTML.
PAN-OS 6.1.17 and earlier, PAN-OS 7.0.16 and earlier, PAN-OS 7.1.11 and earlier, PAN-OS 8.0.2 and earlier
PAN-OS 6.1.18 and later, PAN-OS 7.0.17 and later, PAN-OS 7.1.12 and later, PAN-OS 8.0.3 and later
Customers that have not configured GlobalProtect are not affected by this issue.
Palo Alto Networks would like to thank Sonal Shrivastava of PayPal for reporting this issue to us.