CVE-2019-1567 Stored Cross-Site Scripting in Expedition Migration Tool

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Scope CHANGED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Published 2019-02-28

Updated 2020-08-25

Reference MT-908 PAN-SA-2019-0003

Discovered externally

A stored cross-site scripting (XSS) vulnerability exists in the Palo Alto Networks Migration Tool (“Expedition”). (Ref # MT-908/ CVE-2019-1567)

Successful exploitation of this issue may allow an authenticated attacker to inject arbitrary JavaScript or HTML in the User Mapping Settings.

This issue affects Expedition 1.1.6 and earlier

Versions	Affected	Unaffected
Expedition 1.1	<= 1.1.6	>= 1.1.7

Expedition 1.1.7 and later

N/A

Palo Alto Networks would like to thank Sayali Kulkarni of Tenable for reporting this issue.