Palo Alto Networks Security Advisories / CVE-2019-1574

CVE-2019-1574 Cross-Site Scripting in Expedition Migration Tool

047910
Severity 5.4 · MEDIUM
Attack Vector NETWORK
Attack Complexity LOW
Privileges Required LOW
User Interaction REQUIRED
Scope CHANGED
Confidentiality Impact LOW
Integrity Impact LOW
Availability Impact NONE

Description

A cross-site scripting (XSS) vulnerability exist in the Palo Alto Networks Migration Tool (“Expedition”). (Ref # MT-1009/ CVE-2019-1574)

Successful exploitation of this issue may allow an authenticated attacker to inject arbitrary JavaScript or HTML in the Devices View.

This issue affects Expedition 1.1.12 and earlier.

Note that this issue only impacts the Palo Alto Networks Migration Tool (“Expedition”), a tool available from the Palo Alto Networks Live site. This issue does not affect PAN-OS or any other supported product or service. For more information on Expedition, see: https://live.paloaltonetworks.com/t5/Expedition-Migration-Tool/ct-p/migration_tool.

Product Status

Expedition

VersionsAffectedUnaffected
1.1<= 1.1.12>= 1.1.13

Severity: MEDIUM

CVSSv3.1 Base Score: 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Weakness Type

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Solution

Expedition 1.1.13 and later

Workarounds and Mitigations

n/a

Acknowledgments

Palo Alto Networks would like to thank Sayali Kulkarni of Tenable Research for reporting this issue.
© 2020 Palo Alto Networks, Inc. All rights reserved.