Skip to content
CVE Tracker
Back

CVE-2023-0010

PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication

Medium5.4EPSS 0.37%
Published
Updated
Reserved
Assigned by
palo_alto

Description

A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.

Scores

CVSS scores of CVE-2023-0010, by who scored it
Scored byCVSSScoreVector
palo_altoCNA (assigner)3.1Medium5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVDNVD · Modified3.1Medium5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS (exploitation in 30 days)
0.37% · top 69% of all CVEs (2 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.

Weakness

Affected products

  • Palo Alto Networks · PAN-OS

    • unaffected 11.0
    • affected 10.2 – < 10.2.2
    • affected 10.1 – < 10.1.6
    • affected 10.0 – < 10.0.11
    • affected 9.1 – < 9.1.16
    • affected 9.0 – < 9.0.17
    • affected 8.1 – < 8.1.24

  • Palo Alto Networks · Cloud NGFW

    • unaffected All

  • Palo Alto Networks · Prisma Access

    • unaffected All

What to do

Solution: This issue is fixed in PAN-OS 8.1.24, PAN-OS 9.0.17, PAN-OS 9.1.16, PAN-OS 10.0.11, PAN-OS 10.1.6, PAN-OS 10.2.2, and all later PAN-OS versions.

Exploitation: Palo Alto Networks is not aware of any malicious exploitation of this issue.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .