CVE-2020-2012 — PAN-OS: Panorama: XML external entity reference ('XXE') vulnerability leads the to information leak

Back Back to CVE browser

HIGH

PAN-OS: Panorama: XML external entity reference ('XXE') vulnerability leads the to information leak

Published May 13, 2020

7.5

HIGH

CVSS 3.1

EPSS 1.98%

Description

Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrary files on the system. This issue affects: All versions of PAN-OS for Panorama 7.1 and 8.0; PAN-OS for Panorama 8.1 versions earlier than 8.1.13; PAN-OS for Panorama 9.0 versions earlier than 9.0.7.

Affected products

Vendor Palo Alto Networks Product Pan-OS Default
n/a
- Version
  7.1.*
  Status
  affected
  Constraints
  -
- Version
  8.0.*
  Status
  affected
  Constraints
  -
- Version
  8.1
  Status
  affected
  Constraints
  <8.1.13
- Version
  9.0
  Status
  affected
  Constraints
  <9.0.7
- Version
  9.1.0
  Status
  unaffected
  Constraints
  <9.1*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Palo Alto Networks

Pan-OS

n/a

Version	Status	Constraints
7.1.*	affected	-
8.0.*	affected	-
8.1	affected	<8.1.13
9.0	affected	<9.0.7
9.1.0	unaffected	<9.1*

Remediation

Vendor solution

This issue is fixed in PAN-OS 8.1.13, PAN-OS 9.0.7, PAN-OS 9.1.0, and all later PAN-OS versions.

PAN-OS 8.0 is now end-of-life as of October 31, 2019, and is no longer covered by our Product Security Assurance policies.

PAN-OS 7.1 is on extended support until June 30, 2020, and is only being considered for critical security vulnerability fixes.

Metrics

1.98% 0.01983

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01983

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (24 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.98% (0.01983)	79.82th	v5 (v2026.06.15)
Jun 15, 2026	1.93% (0.01935)	77.34th	v5 (v2026.06.15)
Dec 28, 2025	3.51% (0.03507)	87.25th	v4 (v2025.03.14)
Dec 27, 2025	1.99% (0.01990)	83.22th	v4 (v2025.03.14)
Oct 28, 2025	3.51% (0.03507)	87.08th	v4 (v2025.03.14)
Oct 27, 2025	1.99% (0.01990)	83.02th	v4 (v2025.03.14)
Oct 1, 2025	3.51% (0.03507)	87.18th	v4 (v2025.03.14)
Jul 30, 2025	1.99% (0.01990)	82.86th	v4 (v2025.03.14)
Mar 30, 2025	3.51% (0.03507)	86.50th	v4 (v2025.03.14)
Mar 29, 2025	6.54% (0.06544)	84.81th	v4 (v2025.03.14)
Mar 17, 2025	3.51% (0.03507)	86.82th	v4 (v2025.03.14)
Jul 20, 2024	0.38% (0.00378)	73.14th	v3 (v2023.03.01)
Jun 22, 2024	0.38% (0.00378)	73.01th	v3 (v2023.03.01)
Feb 8, 2024	0.28% (0.00279)	67.43th	v3 (v2023.03.01)
Jan 29, 2024	0.28% (0.00279)	65.05th	v3 (v2023.03.01)
Sep 3, 2023	0.29% (0.00290)	65.10th	v3 (v2023.03.01)
Mar 7, 2023	0.28% (0.00283)	63.61th	v3 (v2023.03.01)
Mar 6, 2023	1.05% (0.01055)	52.13th	v2 (v2022.01.01)
Apr 1, 2022	1.05% (0.01055)	48.43th	v2 (v2022.01.01)
Feb 4, 2022	9.03% (0.09029)	86.86th	v2 (v2022.01.01)
Feb 3, 2022	2.30% (0.02304)	53.71th	v5 (v2026.06.15)
Jan 6, 2022	2.30% (0.02304)	53.25th	v1
Sep 1, 2021	0.52% (0.00523)	32.27th	v1
Apr 14, 2021	0.52% (0.00523)	0.00th	v1

Weaknesses (1)

CWE-611

XXE

References (1)

https://security.paloaltonetworks.com/CVE-2020-2012
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://security.paloaltonetworks.com/CVE-2020-2012		x_refsource_MISCVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner palo_alto

Published May 13, 2020

Updated Sep 17, 2024

Reserved Dec 4, 2019

Link CVE-2020-2012

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-2012

Red Hat

Severity n/a

Public date n/a

Links CVE-2020-2012