CVE-2023-0010: PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication
First published: Wed Jun 14 2023(Updated: )
A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.
Credit: psirt@paloaltonetworks.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Paloaltonetworks Pan-os | >=8.1.0<=8.1.24 | |
| Paloaltonetworks Pan-os | >=9.0.0<=9.0.17 | |
| Paloaltonetworks Pan-os | >=9.1.0<=9.1.16 | |
| Paloaltonetworks Pan-os | >=10.0.0<=10.0.11 | |
| Paloaltonetworks Pan-os | >=10.1.0<=10.1.6 | |
| Paloaltonetworks Pan-os | >=10.2.0<=10.2.2 |
Remedy
This issue is fixed in PAN-OS 8.1.24, PAN-OS 9.0.17, PAN-OS 9.1.16, PAN-OS 10.0.11, PAN-OS 10.1.6, PAN-OS 10.2.2, and all later PAN-OS versions.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-0010?
CVE-2023-0010 is a reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software.
How does CVE-2023-0010 affect Palo Alto Networks PAN-OS software?
CVE-2023-0010 allows a JavaScript payload to be executed in the context of an authenticated Captive Portal user's browser when they click on a specifically crafted link.
What version of Palo Alto Networks PAN-OS software are affected by CVE-2023-0010?
Palo Alto Networks PAN-OS software versions 8.1.0 to 8.1.24, 9.0.0 to 9.0.17, 9.1.0 to 9.1.16, 10.0.0 to 10.0.11, 10.1.0 to 10.1.6, and 10.2.0 to 10.2.2 are affected by CVE-2023-0010.
What is the severity of CVE-2023-0010?
CVE-2023-0010 has a severity rating of 5.4 (medium).
How can I find more information about CVE-2023-0010?
You can find more information about CVE-2023-0010 on the Palo Alto Networks website: https://security.paloaltonetworks.com/CVE-2023-0010.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/remedy
- agent/title
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/paloaltonetworks
- canonical/paloaltonetworks pan-os
- version/paloaltonetworks pan-os/8.1.0
- version/paloaltonetworks pan-os/8.1.24
- version/paloaltonetworks pan-os/9.0.0
- version/paloaltonetworks pan-os/9.0.17
- version/paloaltonetworks pan-os/9.1.0
- version/paloaltonetworks pan-os/9.1.16
- version/paloaltonetworks pan-os/10.0.0
- version/paloaltonetworks pan-os/10.0.11
- version/paloaltonetworks pan-os/10.1.0
- version/paloaltonetworks pan-os/10.1.6
- version/paloaltonetworks pan-os/10.2.0
- version/paloaltonetworks pan-os/10.2.2