Missing XML Validation in PAN-OS Web Interface
Published Feb 12, 2020
8.8
HIGHCVSS 3.1
EPSS 1.00%
Description
Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions.
Affected products
-
Affected
- ≥ 8.1, < 8.1.12
- ≥ 9.0, < 9.0.6
Unaffected
- 7.1.*
- 8.0.*
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Palo Alto Networks | Pan-OS | unknown | Affected
Unaffected
|
- ≥ 8.1.0 · < 8.1.12
- ≥ 9.0.0 · < 9.0.6
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
This issue is fixed in PAN-OS 8.1.12, PAN-OS 9.0.6, and all later versions.
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-12765 Advisory
- https://security.paloaltonetworks.com/CVE-2020-1975 x_refsource_MISCVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-12765 | Advisory | |
| https://security.paloaltonetworks.com/CVE-2020-1975 | x_refsource_MISCVendor Advisory |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
No data
Red Hat
No data
GitHub
No data