CVE-2020-1996
PAN-OS: Panorama management server log injection
MEDIUM 5.3
At a glance
- Source
- NVD
- EPSS
- EPSS 0.91 % · percentile 60 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- palo_alto
- NVD status
- Modified
Description
A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthenticated user to inject messages into the management server ms.log file. This vulnerability can be leveraged to obfuscate an ongoing attack or fabricate log entries in the ms.log file This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.9.
Weaknesses (CWE)
- CWE-862 — Missing Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | palo_alto |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | NVD · psirt@paloaltonetworks.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2020-12786
- GCVE · GCVE-0-2020-1996
CERT-FR advisories
- CERTFR-2020-AVI-290 — Multiples vulnérabilités dans Palo Alto PAN-OS et GlobalProtect · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 7.1.0 ≤ 7.1.26cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 8.0.0 ≤ 8.0.20cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 8.1.0 ≤ 8.1.13cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 9.0.0 ≤ 9.0.8
Affected products
| Product | Versions |
|---|---|
| Palo Alto Networks · PAN-OS | affected 7.1.* ; affected 8.0.* ; affected 8.1 < 8.1.14 ; affected 9.0 < 9.0.9 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |