CVE-2023-6790 is a medium to high severity vulnerability affecting certain versions of Palo Alto Networks PAN-OS software. This DOM-Based cross-site scripting (XSS) vulnerability allows a remote attacker to execute a JavaScript payload in the context of an administrator's browser when they view a specifically crafted link to the PAN-OS web interface. Systems running specific versions of the PAN-OS software are at risk, and users are advised to update to the latest fixed versions to mitigate the vulnerability.

How do I know if I'm affected?

To determine if you're affected by the CVE-2023-6790 vulnerability, you'll need to check your PAN-OS software version. If it falls within the following ranges, you're at risk: 8.1.0 to 8.1.25, 9.0.0 to 9.0.17, 9.1.0 to 9.1.16, 10.0.0 to 10.0.12, 10.1.0 to 10.1.9, 10.2.0 to 10.2.4, or version 11.0.0. This vulnerability is a DOM-Based Cross-Site Scripting (XSS) issue that allows a remote attacker to execute a JavaScript payload in an administrator's browser when viewing a specially crafted link to the PAN-OS web interface.

What should I do if I'm affected?

If you're affected by the CVE-2023-6790 vulnerability, update your PAN-OS software to a fixed version: 8.1.25, 9.0.17, 9.1.16, 10.0.12, 10.1.9, 10.2.4, or 11.0.1. Be cautious when upgrading to avoid reintroducing certificate issues. This will help protect your system from unauthorized access and data manipulation.

Is CVE-2023-6790 in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-6790 vulnerability is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. This DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software was added to the catalog on December 13, 2023. The required action is to update the affected PAN-OS software to a fixed version, as mentioned in the vendor advisory. However, the catalog does not provide a specific due date for taking this action.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as Improper Neutralization of Input During Web Page Generation CWE-79, which allows remote attackers to execute JavaScript payloads in an administrator's browser through specially crafted links.

For more details

CVE-2023-6790 is a significant vulnerability in PAN-OS software, with potential consequences for affected systems. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD or the link below.

• Palo Alto Networks Security Advisory