Cross-site scripting in Palo Alto PAN-OS - #VU1042

Vulnerability identifier: #VU1042

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: N/A

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote authenticated user to perform cross-site scripting (XSS) attacks.
The vulnerability is caused by incorrect filtration of input data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary JavaScript in victim’s browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Palo Alto PAN-OS
openEuler

vte291
vte291-debuginfo
vte291-debugsource
vte291-devel

Update to version 5.0.20 and later,
Update to version 5.1.13 and later,
Update to version 6.0.15 and later,
Update to version 6.1.13 and later,
Update to version 7.0.8 and later.

vte291 - update to 0.62.3-2
vte291-debuginfo - update to 0.62.3-2
vte291-debugsource - update to 0.62.3-2
vte291-devel - update to 0.62.3-2

• http://securityadvisories.paloaltonetworks.com/Home/Detail/62

• Cross-site scripting in Palo Alto PAN-OS
• openEuler 22.03 LTS SP3 update for vte291