Log in Start free

Vulnerability · Published Sep 9, 2020 · Assigned by palo_alto

CVE-2020-2039PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file upload

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in PAN-OS from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 46.4% (higher than 99% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)46.4%top 1.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted after the request is finished. It is possible for an attacker to disrupt the availability of the management web interface by repeatedly uploading files until available disk space is exhausted. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.

Affected products (as reported)

VendorProductVersions
Palo Alto Networks PAN-OS 9.1 – before 9.1.48.1 – before 8.1.169.0 – before 9.0.1010.0 – before 10.0.1

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References