CVE-2024-0011

PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication

State: Published
Severity: 4.3 Medium
Published: Feb 14, 2024
Updated: Aug 1, 2024
Reserved: Nov 9, 2023

Description

A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript (in the context of an authenticated Captive Portal user’s browser) if a user clicks on a malicious link, allowing phishing attacks that could lead to credential theft.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	palo_alto

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
PAN-OSPalo Alto Networks	8.1 to before 8.1.24Affectedfrom 8.1.24Not affected 9.0 to before 9.0.17Affectedfrom 9.0.17Not affected 9.1 to before 9.1.13Affectedfrom 9.1.13Not affected 10.0 to before 10.0.11Affectedfrom 10.0.11Not affected 10.1 to before 10.1.3Affectedfrom 10.1.3Not affected 10.2Not affected 11.0Not affected 11.1Not affected
Prisma AccessPalo Alto Networks	AllNot affected
Cloud NGFWPalo Alto Networks	AllNot affected

References

https://security.paloaltonetworks.com/CVE-2024-0011

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.