CVE-2024-5906CWE-79

Prisma Cloud Compute: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

Medium · published June 12, 2024

CVSS v4.0
4.8
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

A cross-site scripting (XSS) vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for identity providers to store a JavaScript payload using the web interface on Prisma Cloud Compute. This enables a malicious administrator to perform actions in the context of another user's browser when accessed by that other user.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:M/U:Amber
EPSS
0.00247 · 15.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-06-12T16:22Z
EPSS history
Timeline
  • 12 JUN 16:22Z
    Prisma Cloud Compute: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
    cvelistv5