Description
A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute arbitrary JavaScript code in the administrator's browser and perform administrative actions. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Palo Alto Networks | PAN-OS | 9.0 – < 9.0.9, 8.1 – < 8.1.16 | 9.0.9 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting http/cves/2020/CVE-2020-2036.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.