Palo Alto Networks Security Advisories / CVE-2015-2223

CVE-2015-2223 ESM Console XSS vulnerability

047910
Severity 4.2 · MEDIUM
Attack Vector NETWORK
Attack Complexity HIGH
Privileges Required NONE
User Interaction REQUIRED
Scope UNCHANGED
Confidentiality Impact LOW
Integrity Impact LOW
Availability Impact NONE

Description

A cross-site scripting vulnerability exists in the web-based console management. This vulnerability has been assigned CVE-2015-2223.

This issue affects the management interface of Traps, where an authenticated administrator may be tricked into injecting malicious JavaScript into the web UI interface.

This issue affects Traps ESM Console version 3.2.1 and earlier

Product Status

VersionsAffectedUnaffected
Traps ESM Console 3.2< 3.2.1.3559>= 3.2.1.3559
Traps ESM Console 3.1< 3.1.5.3691>= 3.1.5.3691

Severity: MEDIUM

CVSSv3.1 Base Score: 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)

Weakness Type

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Solution

Traps ESM Console 3.1.5.3691 and higher; Traps ESM Console 3.2.1.3559 and higher

Workarounds and Mitigations

Acknowledgments

Michael Hendrickx
© 2020 Palo Alto Networks, Inc. All rights reserved.