Skip to content
OpenAdvisories
Medium · 6.5 CVE-2023-0007 EUVD-2023-12112GHSA-mfm9-435m-m4c2

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface

Published May 10, 2023 · Updated Jan 24, 2025 · Assigned by palo_alto

Vendor: Palo Alto Networks Product: Cloud NGFW Product: PAN-OS Product: Prisma Access Category: Network devices

Description

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administrator’s browser when viewed.

Affected products

VendorProductAffectedFixed
Palo Alto Networks PAN-OS 10.0 – < 10.0.7, 9.1 – < 9.1.16, 9.0 – < 9.0.17, 8.1 – < 8.1.25 10.0.7
Palo Alto Networks Prisma Access — All
Palo Alto Networks Cloud NGFW — All

References