Skip to content
OpenAdvisories
Medium WID-SEC-2023-3151 7 CVEs

PaloAlto Networks PAN-OS: Mehrere Schwachstellen

Published Dec 13, 2023 · Updated Dec 13, 2023 · de-DE

Vendor: Palo Alto Networks Product: PaloAlto Networks PAN-OS 10.0 Product: PaloAlto Networks PAN-OS 10.1 Product: PaloAlto Networks PAN-OS 10.2 Product: PaloAlto Networks PAN-OS 11.0 Product: PaloAlto Networks PAN-OS 11.1 Product: PaloAlto Networks PAN-OS 8.1 Product: PaloAlto Networks PAN-OS 9.0 Product: PaloAlto Networks PAN-OS 9.1 Product: PAN-OS

Summary

Ein Angreifer kann mehrere Schwachstellen in PaloAlto Networks PAN-OS ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service zu verursachen oder Code auszuführen.

Product

PAN-OS ist das Betriebssystem der Sicherheitssysteme / Firewalls der Firma Palo Alto Networks.

Vulnerabilities 7

  • High 8.8
    CVE-2023-6790

    PAN-OS: DOM-Based Cross-Site Scripting (XSS) Vulnerability in the Web Interface

    A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the context of an administrator’s browser when they view a specifically crafted link to the PAN-OS web inte…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 5.5
    CVE-2023-6792

    PAN-OS: OS Command Injection Vulnerability in the XML API

    An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 5.5
    CVE-2023-6794

    PAN-OS: File Upload Vulnerability in the Web Interface

    An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and potentially execute arbitrary code with limited privileges on the f…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 5.5
    CVE-2023-6795

    PAN-OS: OS Command Injection Vulnerability in the Web Interface

    An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 4.9
    CVE-2023-6791

    PAN-OS: Plaintext Disclosure of External System Integration Credentials

    A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credentials of stored external system integrations such as LDAP, SCP, RADIUS, TACACS+, and SNMP from the web i…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 4.3
    CVE-2023-6789

    PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

    A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. Then, when viewed by a properly authenticated administrator, the…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Low 2.7
    CVE-2023-6793

    PAN-OS: XML API Keys Revoked by Read-Only PAN-OS Administrator

    An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API keys from the firewall and disrupt XML API usage.

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices

Revision history

  1. #1

    Initiale Fassung

References