CVE-2020-2012
Last modified
CVE-2020-2012 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrary files on the system. This issue affects: All versions of PAN-OS for Panorama 7.1 and 8.0; PAN-OS for Panorama 8.1 versions earlier than 8.1.13; PAN-OS for Panorama 9.0 versions earlier than 9.0.7.. EPSS estimates a 1.93% chance of exploitation in the next 30 days.
Description
Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrary files on the system. This issue affects: All versions of PAN-OS for Panorama 7.1 and 8.0; PAN-OS for Panorama 8.1 versions earlier than 8.1.13; PAN-OS for Panorama 9.0 versions earlier than 9.0.7.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Paloaltonetworks | Pan-Os | >= 7.1.0, <= 7.1.26 |
| Paloaltonetworks | Pan-Os | >= 8.0.0, <= 8.0.20 |
| Paloaltonetworks | Pan-Os | >= 8.1.0, < 8.1.13 |
| Paloaltonetworks | Pan-Os | >= 9.0.0, < 9.0.7 |
References
- https://security.paloaltonetworks.com/CVE-2020-2012Vendor Advisory
- https://security.paloaltonetworks.com/CVE-2020-2012Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-2012?
How severe is CVE-2020-2012?
How do I fix CVE-2020-2012?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-20094Instagram iOS 106.0 and prior and Android 107.0.0.11 and pri…6.5
- CVE-2020-20095iMessage (Messages app) iOS 12.4 and prior user interface do…6.5
- CVE-2020-20096Whatsapp iOS 2.19.80 and prior and Android 2.19.222 and prio…6.5
- CVE-2020-2010An OS command injection vulnerability in PAN-OS management i…7.2
- CVE-2020-2011An improper input validation vulnerability in the configurat…7.5
- CVE-2020-20118Buffer Overflow vulnerability in Avast AntiVirus before v.19…5.5
- CVE-2020-20120ThinkPHP v3.2.3 and below contains a SQL injection vulnerabi…9.8
- CVE-2020-20122Wuzhi CMS v4.1 contains a SQL injection vulnerability in the…9.8
- CVE-2020-20124Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vuln…8.8
- CVE-2020-20125EARCLINK ESPCMS-P8 contains a cross-site scripting (XSS) vul…6.1
- CVE-2020-20128LaraCMS v1.0.1 transmits sensitive information in cleartext …7.5
- CVE-2020-20129LaraCMS v1.0.1 contains a stored cross-site scripting (XSS) …5.4
Are you affected by CVE-2020-2012?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST