PT-2018-1699 · Palo Alto Networks · Pan-Os

Brandon Freshour · Published 2018-08-15 · Updated 2020-02-17 · CVE-2018-10139

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 6.1.21 and earlier Palo Alto Networks PAN-OS versions 7.1.18 and earlier Palo Alto Networks PAN-OS versions 8.0.11 and earlier

Description The issue is caused by insufficient protection of the web page structure, allowing an unauthenticated attacker to inject arbitrary JavaScript or HTML. This can be exploited by a remote attacker. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For versions 6.1.21 and earlier, update to a version later than 6.1.21. For versions 7.1.18 and earlier, update to a version later than 7.1.18. For versions 8.0.11 and earlier, update to a version later than 8.0.11. As a temporary workaround, consider restricting access to the GlobalProtect Gateway to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2018-01259

CVE-2018-10139

Affected Products

Pan-Os

References · 9

• https://osv.dev/vulnerability/CVE-2018-10139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10139 · Security Note
• https://bdu.fstec.ru/vul/2018-01259 · Security Note
• https://securityadvisories.paloaltonetworks.com/Home/Detail/128?AspxAutoDetectCookieSupport=1 · Note
• https://paloaltonetworks.co.uk/content/pan/en_US/documentation/81/pan-os/pan-os-release-notes/pan-os-8-1-addressed-issues/pan-os-8-1-0-addressed-issues.html · Note
• https://security.paloaltonetworks.com/CVE-2018-10139 · Note
• http://securitytracker.com/id/1041544 · Note
• https://cybersecurity-help.cz/vdb/SB2018082705 · Note
• http://securityfocus.com/bid/105111 · Note