jQuery vulnerability on management interface of PA-3220

[kawai818]

Hello all,

Our customer is currently using PA-3220 running PAN-OS 11.1.
During their recent vulnerability scan, the following CVEs were reported that jQuery used on the Web management interface;

CVE-2018-8046
CVE-2007-6758

Questions:
1. Do these vulnerabilities actually affect? Or false positive from their vulnerability scanner?
2. What is the purpose of using jQuery in the Web management interface?

Thank you for your support.

Shinichi

[OtakarKlier]

Hello,

Run the scans again but slow them down. See if you get the same results. Sometimes fast unauthenticated scans give false positives.

Regards,

[kawai818]

Hi OtakarKlier,

Thank you for your reply.
Unfortunately, they said it would be difficult to run a vulnerability scan again.
Since those CVEs are not currently listed in the "Palo Alto Networks Security Advisories" information, I have concluded that they are not affected.

Thank you.
Shinichi