Palo Alto Networks Security Advisories / CVE-2024-0011

CVE-2024-0011 PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication

Severity 5.1 · MEDIUM
Response Effort LOW
Value Density DIFFUSE
Attack Vector NETWORK
Attack Complexity LOW
Attack Requirements NONE
Automatable NO
User Interaction ACTIVE
Product Confidentiality NONE
Product Integrity LOW
Product Availability NONE
Privileges Required NONE
Subsequent Confidentiality NONE
Subsequent Integrity NONE
Subsequent Availability NONE


A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user’s browser if that user clicks on a malicious link, allowing phishing attacks that could lead to credential theft.

Product Status

Cloud NGFW NoneAll
PAN-OS 11.1NoneAll
PAN-OS 11.0NoneAll
PAN-OS 10.2NoneAll
PAN-OS 10.1< 10.1.3>= 10.1.3
PAN-OS 10.0< 10.0.11>= 10.0.11
PAN-OS 9.1< 9.1.13>= 9.1.13
PAN-OS 9.0< 9.0.17>= 9.0.17
PAN-OS 8.1< 8.1.24>= 8.1.24
Prisma Access NoneAll

Required Configuration for Exposure

This issue is applicable only to firewalls that are configured to use Captive Portal authentication. You can verify whether you have Captive Portal configured in the Captive Portal Settings page (Device > User Identification > Captive Portal Settings).

Severity: MEDIUM

CVSSv4.0 Base Score: 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Weakness Type

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')


This issue is fixed in PAN-OS 8.1.24, PAN-OS 9.0.17, PAN-OS 9.1.13, PAN-OS 10.0.11, PAN-OS 10.1.3, and all later PAN-OS versions.

Workarounds and Mitigations

Customers with a Threat Prevention subscription can block attacks for this vulnerability by enabling Threat ID 93070 (Applications and Threats content update 8810).


Palo Alto Networks thanks Darek Jensen and an external reporter for discovering and reporting this issue.


Initial publication
© 2024 Palo Alto Networks, Inc. All rights reserved.