CVE-2017-9467 Cross-Site Scripting in PAN-OS

Palo Alto Networks Security Advisories / CVE-2017-9467

CVE-2017-9467 Cross-Site Scripting in PAN-OS

Severity 6.1 · MEDIUM

Attack Vector NETWORK

Scope CHANGED

Attack Complexity LOW

Confidentiality Impact LOW

Privileges Required NONE

Integrity Impact LOW

User Interaction REQUIRED

Availability Impact NONE

NVD JSON

Published 2017-07-20

Updated

Reference PAN-77294 PAN-SA-2017-0020

Description

A vulnerability exists in the PAN-OS GlobalProtect external interface that could allow for a cross-site scripting (XSS) attack. PAN-OS does not properly validate specific request parameters. (Ref # PAN-77294 / CVE-2017-9467)

Successful exploitation of this issue may allow an attacker to inject arbitrary Java script or HTML.

This issue affects PAN-OS 6.1.17 and earlier, PAN-OS 7.0.15 and earlier, PAN-OS 7.1.10 and earlier, PAN-OS 8.0.2 and earlier

Product Status

Versions	Affected	Unaffected
PAN-OS 8.0	<= 8.0.2	>= 8.0.3
PAN-OS 7.1	<= 7.1.10	>= 7.1.11
PAN-OS 7.0	<= 7.0.15	>= 7.0.16
PAN-OS 6.1	<= 6.1.17	>= 6.1.18

Severity: MEDIUM

CVSSv3.0 Base Score: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness Type

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Solution

PAN-OS 6.1.18 and later, PAN-OS 7.0.16 and later, PAN-OS 7.1.11 and later, PAN-OS 8.0.3 and later

Workarounds and Mitigations

Customers that have not configured GlobalProtect are not affected by this issue.

Acknowledgments

Palo Alto Networks would like to thank Jarrod Phelps from Uber for reporting this issue to us.