CVE-2018-10141 Cross-Site Scripting (XSS) in GlobalProtect Portal Login Page
Attack Vector
NETWORK
Scope
CHANGED
Attack Complexity
LOW
Confidentiality Impact
LOW
Privileges Required
NONE
Integrity Impact
LOW
User Interaction
REQUIRED
Availability Impact
NONE
Description
A Cross-Site Scripting (XSS) vulnerability exists in the PAN-OS GlobalProtect Portal Login page. (Ref. # PAN-99830; CVE-2018-10141)
Successful exploitation of this issue may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML.
This issue affects PAN-OS 8.1.3 and earlier. PAN-OS 8.0, PAN-OS 7.1 and PAN-OS 6.1 are NOT affected.
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| PAN-OS 8.1 | <= 8.1.3 | >= 8.1.4 |
Severity: MEDIUM
CVSSv3.1 Base Score: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness Type
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Solution
PAN-OS 8.1.4 and later
Workarounds and Mitigations
Customers not using GlobalProtect feature of PAN-OS are not impacted by this vulnerability.
Acknowledgments
Palo Alto Networks would like to thank Vladimir Egorov, Team of cyberhouse.ge, okradze, and Mina Mohsen Edwar with Verizon for reporting this issue.