CVE-2024-0011

{"id": "CVE-2024-0011", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@paloaltonetworks.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-02-14T18:15:47.897", "references": [{"url": "https://security.paloaltonetworks.com/CVE-2024-0011", "tags": ["Vendor Advisory"], "source": "psirt@paloaltonetworks.com"}, {"url": "https://security.paloaltonetworks.com/CVE-2024-0011", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@paloaltonetworks.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript (in the context of an authenticated Captive Portal user\u2019s browser) if a user clicks on a malicious link, allowing phishing attacks that could lead to credential theft."}, {"lang": "es", "value": "Una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en la funci\u00f3n Portal cautivo del software PAN-OS de Palo Alto Networks permite la ejecuci\u00f3n de JavaScript malicioso (en el contexto del navegador de un usuario autenticado del Portal cautivo) si un usuario hace clic en un enlace malicioso, lo que permite Ataques de phishing que podr\u00edan conducir al robo de credenciales."}], "lastModified": "2024-12-09T15:05:57.857", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7D77695-CFDE-4BAE-8C8B-E389CC5C7A3F", "versionEndExcluding": "8.1.24", "versionStartIncluding": "8.1.0"}, {"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89A55C5F-8E01-42C4-BE93-D683900C07BE", "versionEndExcluding": "9.0.17", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9AB9A952-7A40-40C9-A8B4-2227F18555B4", "versionEndExcluding": "9.1.13", "versionStartIncluding": "9.1.0"}, {"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30D919C6-068E-4C81-A7A7-261F0D9E4B66", "versionEndExcluding": "10.0.11", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40AFDDF3-0AB4-4A18-93E9-01EE5BDE9D2E", "versionEndExcluding": "10.1.3", "versionStartIncluding": "10.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@paloaltonetworks.com"}