CVE-2024-5906: Prisma Cloud Compute: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
A cross-site scripting (XSS) vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for identity providers to store a JavaScript payload using the web interface on Prisma Cloud Compute. This enables a malicious administrator to perform actions in the context of another user's browser when accessed by that other user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Palo Alto Networks Prisma Cloud Computeto a version that resolves this vulnerability.Fixed in 32.05 (O'Neal - Update 5)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5906?
CVE-2024-5906 is classified as a high severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2024-5906?
To fix CVE-2024-5906, ensure that Prisma Cloud Compute is updated to the latest version beyond 32.05.124 that includes the security patch.
Who is affected by CVE-2024-5906?
CVE-2024-5906 affects administrators with add/edit permissions for identity providers in Palo Alto Networks Prisma Cloud Compute.
What type of vulnerability is CVE-2024-5906?
CVE-2024-5906 is a cross-site scripting (XSS) vulnerability that allows the storage of malicious JavaScript payloads.
What potential impact does CVE-2024-5906 have?
The potential impact of CVE-2024-5906 allows a malicious administrator to execute harmful scripts in the context of affected user sessions.