Palo Alto Networks PAN-OS CVE-2014-3764 Cross Site Scripting Vulnerability

Bugtraq ID:	71773
Class:	Input Validation Error
CVE:	CVE-2014-3764
Remote:	Yes
Local:	No
Published:	Dec 23 2014 12:00AM
Updated:	Mar 19 2015 08:17AM
Credit:	Avi Gimpel and Oded Vanunu, Check Point Security Research Team
Vulnerable:
Not Vulnerable:

Palo Alto Networks PAN-OS CVE-2014-3764 Cross Site Scripting Vulnerability

Palo Alto Networks PAN-OS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

The following are vulnerable:

PAN-OS 6.0.5 and prior
PAN-OS 5.1.9 and prior
PAN-OS 5.0.14 and prior

Palo Alto Networks PAN-OS CVE-2014-3764 Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Palo Alto Networks PAN-OS CVE-2014-3764 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Palo Alto Networks PAN-OS CVE-2014-3764 Cross Site Scripting Vulnerability

References:

• Palo Alto Networks Homepage (Palo Alto Networks)
  
• PAN-SA-2014-0007: Cross-site scripting vulnerability (Palo Alto Networks)