Palo Alto Networks Security Advisories / CVE-2017-7409

CVE-2017-7409 Cross-Site Scripting in PAN-OS

047910
Severity 6.1 · MEDIUM
Attack Vector NETWORK
Attack Complexity LOW
Privileges Required NONE
User Interaction REQUIRED
Scope CHANGED
Confidentiality Impact LOW
Integrity Impact LOW
Availability Impact NONE

Description

A vulnerability exists in the PAN-OS GlobalProtect external interface that could allow for a cross-site scripting (XSS) attack. PAN-OS does not properly validate specific request parameters. (Ref # PAN-70674 / CVE-2017-7409)

Successful exploitation of this issue may allow an attacker to inject arbitrary Javascript or HTML.

This issue affects PAN-OS 7.0.14 and earlier

Product Status

VersionsAffectedUnaffected
PAN-OS 7.0<= 7.0.14>= 7.0.15

Severity: MEDIUM

CVSSv3.1 Base Score: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness Type

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Solution

PAN-OS 7.0.15 and later

Workarounds and Mitigations

Customers that have not configured GlobalProtect are not affected by this issue.

Acknowledgments

Palo Alto Networks would like to thank Jarrod Phelps from Uber for reporting this issue to us.
© 2020 Palo Alto Networks, Inc. All rights reserved.