CVE-2023-0010CWE-79

PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication

Medium · published June 14, 2023

CVSS v3.1
5.4
EPSS
0%
Percentile
29.7
In the wild
Unconfirmed
What it is

A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00372 · 29.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-06-14T16:31Z
EPSS history
Timeline
  • 14 JUN 16:31Z
    PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication
    cvelistv5