CVE-2020-1975 — Missing XML Validation in Palo Alto Networks Pan-os

CWE-112 — Missing XML ValidationCWE-611 — XML External Entity (XXE) Injection4 documents4 sources
Severity
8.8HIGHNVD
CNA6.8
EPSS
0.4%
top 40.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Palo Alto Networks Pan-osPaloaltonetworks Pan-osPaloalto Pan-os
Timeline
PublishedFeb 12
Latest updateMay 24

Description

Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDpaloaltonetworks/pan-os8.1.0 — 8.1.12+1
▶CVEListV5palo_alto_networks/pan-os8.1 — 8.1.12+1
▶Palo Altopaloalto/pan-os

🔴Vulnerability Details

2
GHSA
GHSA-m6cf-g9vq-wjwm: Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary↗2022-05-24
▶
CVEList
Missing XML Validation in PAN-OS Web Interface↗2020-02-12
▶

📋Vendor Advisories

1
Palo Alto
Missing XML Validation in PAN-OS Web Interface↗2020-02-12
▶
CVE-2020-1975 — Missing XML Validation in Palo | cvebase