CVE-2018-10141

MEDIUMNuclei

Palo Alto Networks PAN-OS GlobalProtect <8.1.4 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2018-10141 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Palo Alto Networks

Browse Palo Alto Networks / Palo Alto Networks
CVE Listbefore PAN-OS 8.1.4affected

Nuclei templates

1
ProjectDiscoveryMEDIUMPalo Alto Networks PAN-OS GlobalProtect <8.1.4 - Cross-Site ScriptingCVSS 6.1

Palo Alto Networks PAN-OS before 8.1.4 GlobalProtect Portal Login page allows an unauthenticated attacker to inject arbitrary JavaScript or HTML, making it vulnerable to cross-site scripting.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities.

Remediation

Upgrade to Palo Alto Networks PAN-OS GlobalProtect VPN client version 8.1.4 or later to mitigate this vulnerability.

WeaknessesCWE-79
AuthorsdhiyaneshDk
Template tagscvecve2018panosvpnglobalprotectxsspaloaltonetworksvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
Shodan: http.favicon.hash:"-631559155"
Shodan: cpe:"cpe:2.3:o:paloaltonetworks:pan-os"
FOFA: icon_hash="-631559155"
https://security.paloaltonetworks.com/CVE-2018-10141 https://nvd.nist.gov/vuln/detail/CVE-2018-10141 https://github.com/ARPSyndicate/kenzer-templates https://github.com/Elsfa7-110/kenzer-templates

Source: ProjectDiscovery

References

2