Vulnerability · Published May 13, 2020 · Assigned by palo_alto

CVE-2020-2012PAN-OS: Panorama: XML external entity reference ('XXE') vulnerability leads the to information leak

High 7.5

In plain English

A high-severity XML external entity in PAN-OS from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)2.0%top 19.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrary files on the system. This issue affects: All versions of PAN-OS for Panorama 7.1 and 8.0; PAN-OS for Panorama 8.1 versions earlier than 8.1.13; PAN-OS for Panorama 9.0 versions earlier than 9.0.7.

Affected products (as reported)

Vendor	Product	Versions
Palo Alto Networks	PAN-OS	8.0.7.1.8.1 – before 8.1.139.0 – before 9.0.7

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://security.paloaltonetworks.com/CVE-2020-2012 x_refsource_MISC