CVE-2020-2012

PAN-OS: Panorama: XML external entity reference ('XXE') vulnerability leads the to information leak

State: Published
Severity: 7.5 High
Published: May 13, 2020
Updated: Sep 17, 2024
Reserved: Dec 4, 2019

Description

Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrary files on the system. This issue affects: All versions of PAN-OS for Panorama 7.1 and 8.0; PAN-OS for Panorama 8.1 versions earlier than 8.1.13; PAN-OS for Panorama 9.0 versions earlier than 9.0.7.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	palo_alto

Weaknesses

CWE-611 Improper Restriction of XML External Entity Reference ('XXE')

Affected Products

Product	Versions
PAN-OSPalo Alto Networks	8.0.Affected 7.1.Affected 8.1 to before 8.1.13Affectedfrom 8.1.13Not affected 9.0 to before 9.0.7Affectedfrom 9.0.7Not affected 9.1.0 to before 9.1*Not affected

References

https://security.paloaltonetworks.com/CVE-2020-2012

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.