CVE-2020-2034

PAN-OS: OS command injection vulnerability in GlobalProtect portal

State: Published
Severity: 8.1 High
Published: Jul 8, 2020
Updated: Sep 16, 2024
Reserved: Dec 4, 2019

Description

An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect portal feature is not enabled. This issue impacts PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; all versions of PAN-OS 8.0 and PAN-OS 7.1. Prisma Access services are not impacted by this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	palo_alto

Weaknesses

CWE-78 OS Command Injection

Affected Products

Product	Versions
PAN-OSPalo Alto Networks	8.0.Affected 7.1.Affected 9.1 to before 9.1.3Affectedfrom 9.1.3Not affected 9.0 to before 9.0.9Affectedfrom 9.0.9Not affected 8.1 to before 8.1.15Affectedfrom 8.1.15Not affected

References

https://security.paloaltonetworks.com/CVE-2020-2034

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.