7.5high
CVE-2020-2012
PAN-OS: Panorama: XML external entity reference ('XXE') vulnerability leads the to information leak
Published 6 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
2.0%
percentile 81%
Public exploits
0
none known
Summary
Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrary files on the system. This issue affects: All versions of PAN-OS for Panorama 7.1 and 8.0; PAN-OS for Panorama 8.1 versions earlier than 8.1.13; PAN-OS for Panorama 9.0 versions earlier than 9.0.7.
Exploit prediction (EPSS)
1.98% probability of exploitation in the next 30 days, higher than 81% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- Palo Alto Networks PAN-OS
Classification
- Weakness
- CWE-611 Improper Restriction of XML External Entity Reference
- Technology feeds
- Palo Alto PAN-OS (RSS, critical only)
References
- security.paloaltonetworks.com /CVE-2020-2012 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2020-2012
- NVD: CVE-2020-2012
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.