CVE-2012-4043

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-07-26 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in global-protect/login.esp in Palo Alto Networks Global Protect Portal, Global Protect Gateway, and SSL VPN portals 3.1.x through 3.1.11 and 4.0.x through 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the inputStr parameter in a Login action.

Affected products

Palo Alto Global Protected Gateway: 3.1, 3.1.11, 4.0, 4.0.5
Palo Alto Networks: global_protect_portal-3.1, global_protect_portal-3.1.11, global_protect_portal-4.0, global_protect_portal-4.0.5
Palo Alto Ssl Vpn: 3.1, 3.1.11, 4.0, 4.0.5

References

http://blog.abhisek.me/2012/06/xss-on-palo-alto-networks-global.html
http://www.osvdb.org/83896
http://blog.abhisek.me/2012/06/xss-on-palo-alto-networks-global.html
http://www.osvdb.org/83896

Get alerted when CVE-2012-4043 or the next vulnerability affects your stack