CVE-2020-1975: Missing XML Validation in PAN-OS Web Interface
Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 8.1.12 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 9.0.6
Event History
Frequently Asked Questions
What is the severity of CVE-2020-1975?
CVE-2020-1975 is considered a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2020-1975?
To fix CVE-2020-1975, upgrade PAN-OS to version 8.1.12 or higher, or to version 9.0.7 or higher.
Who is affected by CVE-2020-1975?
CVE-2020-1975 affects authenticated users of the PAN-OS web interface on specific versions of the software.
What type of vulnerability is CVE-2020-1975?
CVE-2020-1975 is a missing XML validation vulnerability that allows arbitrary XML injection.
What are the consequences of exploiting CVE-2020-1975?
Exploiting CVE-2020-1975 may lead to privilege escalation, allowing unauthorized access to sensitive functions and data.