CVE-2020-2016 — Insecure Temporary File in Palo Alto Networks Pan-os
CWE-377 — Insecure Temporary FileCWE-362 — Race ConditionCWE-835 — Infinite Loop28 documents17 sources
Severity
7.0HIGHNVD
EPSS
0.2%
top 56.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 13
Latest updateAug 22
Description
A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux user account. This allows an attacker who has escaped the restricted shell as a low privilege administrator, possibly by exploiting another vulnerability, to escalate privileges to become root user. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; …
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9
Affected Packages3 packages
🔴Vulnerability Details
3GHSA▶
GHSA-phhf-m45q-vcxw: A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limit↗2022-05-24
CVEList▶
PAN-OS: Temporary file race condition vulnerability in PAN-OS leads to local privilege escalation↗2020-05-13
💥Exploits & PoCs
3📋Vendor Advisories
8Oracle
▶
Oracle▶
Oracle Oracle REST Data Services Risk Matrix: General (Apache Commons FileUpload) — CVE-2016-1000031↗2020-10-15
Red Hat▶
glibc: iconv when processing invalid multi-byte input sequences fails to advance the input state, which could result in an infinite loop↗2020-07-09
Palo Alto▶
PAN-OS: Temporary file race condition vulnerability in PAN-OS leads to local privilege escalation↗2020-05-13