Cross-Site Scripting in PAN-OS (PAN-SA-2017-0020)

Last revised: 07/20/2017


A vulnerability exists in the PAN-OS GlobalProtect external interface that could allow for a cross-site scripting (XSS) attack. PAN-OS does not properly validate specific request parameters. (Ref # PAN-77294 / CVE-2017-9467)

Severity: Medium

Successful exploitation of this issue may allow an attacker to inject arbitrary Java script or HTML.

Products Affected

PAN-OS 6.1.17 and earlier, PAN-OS 7.0.15 and earlier, PAN-OS 7.1.10 and earlier, PAN-OS 8.0.2 and earlier

Available Updates

PAN-OS 6.1.18 and later, PAN-OS 7.0.16 and later, PAN-OS 7.1.11 and later, PAN-OS 8.0.3 and later

Workarounds and Mitigations

Customers that have not configured GlobalProtect are not affected by this issue.


Palo Alto Networks would like to thank Jarrod Phelps from Uber for reporting this issue to us.