CVE-2024-5906

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A cross-site scripting (XSS) vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for identity providers to store a JavaScript payload using the web interface on Prisma Cloud Compute. This enables a malicious administrator to perform actions in the context of another user's browser when accessed by that other user.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 12, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-59077.0A privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices enables a local user to execute prog CVE-2024-59087.5A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalP CVE-2024-59095.5A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a low privileged local Windows us CVE-2024-59109.8Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attacke CVE-2024-59114.9An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access CVE-2024-59126.8An improper file signature check in Palo Alto Networks Cortex XDR agent may allow an attacker to bypass the Cortex XDR agent's executable bl CVE-2024-59136.8An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the phy CVE-2024-59149.8A command injection issue in Palo Alto Networks Cortex XSOAR CommonScripts Pack allows an unauthenticated attacker to execute arbitrary comm CVE-2024-59157.8A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute pro CVE-2024-59164.4An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose CVE-2024-59174.9A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative CVE-2024-59184.3An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted c