CVE-2020-2038

PAN-OS: OS command injection vulnerability in the management web interface

State: Published
Severity: 7.2 High
Published: Sep 9, 2020
Updated: Sep 16, 2024
Reserved: Dec 4, 2019

Description

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlier than 10.0.1.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	palo_alto

Weaknesses

CWE-78 OS Command Injection

Affected Products

Product	Versions
PAN-OSPalo Alto Networks	8.1.*Not affected 10.0 to before 10.0.1Affectedfrom 10.0.1Not affected 9.0 to before 9.0.10Affectedfrom 9.0.10Not affected 9.1 to before 9.1.4Affectedfrom 9.1.4Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.