CVE-2023-0010

PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication

State: Published
Severity: 5.4 Medium
Published: Jun 14, 2023
Updated: Dec 30, 2024
Reserved: Oct 27, 2022

Description

A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	palo_alto

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
PAN-OSPalo Alto Networks	11.0Not affected 10.2 to before 10.2.2Affectedfrom 10.2.2Not affected 10.1 to before 10.1.6Affectedfrom 10.1.6Not affected 10.0 to before 10.0.11Affectedfrom 10.0.11Not affected 9.1 to before 9.1.16Affectedfrom 9.1.16Not affected 9.0 to before 9.0.17Affectedfrom 9.0.17Not affected 8.1 to before 8.1.24Affectedfrom 8.1.24Not affected
Cloud NGFWPalo Alto Networks	AllNot affected
Prisma AccessPalo Alto Networks	AllNot affected

References

https://security.paloaltonetworks.com/CVE-2023-0010

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.