Palo Alto Networks Security Advisories / CVE-2017-9459

CVE-2017-9459 Cross-Site Scripting in the Management Web Interface

047910
Severity 6.1 · MEDIUM
Attack Vector NETWORK
Attack Complexity LOW
Privileges Required NONE
User Interaction REQUIRED
Scope CHANGED
Confidentiality Impact LOW
Integrity Impact LOW
Availability Impact NONE

Description

A reflected cross-site scripting (XSS) vulnerability exists in the management web interface. PAN-OS contains an unauthenticated vulnerability that may allow for a reflected cross-site scripting (XSS) attack of the management web interface. (ref # PAN-76455 / CVE-2017-9459).

Successful exploitation of this issue may allow an attacker to inject arbitrary Java script or HTML.

This issue affects PAN-OS 6.1.17 and earlier, PAN-OS 7.0.15 and earlier, PAN-OS 7.1.10 and earlier, PAN-OS 8.0.2 and earlier

Product Status

VersionsAffectedUnaffected
PAN-OS 8.0<= 8.0.2>= 8.0.3
PAN-OS 7.1<= 7.1.10>= 7.1.11
PAN-OS 7.0<= 7.0.15>= 7.0.16
PAN-OS 6.1<= 6.1.17>= 6.1.18

Severity: MEDIUM

CVSSv3.1 Base Score: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness Type

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Solution

PAN-OS 6.1.18 and later, PAN-OS 7.0.16 and later, PAN-OS 7.1.11 and later, PAN-OS 8.0.3 and later

Workarounds and Mitigations

Palo Alto Networks recommends to implement best practice by allowing web interface access only to a dedicated management network. Additionally, restrict the set of IP addresses to a subset of authorized sources that you allow to interact with the management network.

Acknowledgments

Palo Alto Networks would like to thank Juan Lopez of Inqwest for reporting this issue to us.
© 2020 Palo Alto Networks, Inc. All rights reserved.