CVE-2020-1975 - OpenCVE

Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:S/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Paloaltonetworks	Pan-os

Configuration 1 [-]

OR	cpe:2.3:o:paloaltonetworks:pan-os::::::::
	cpe:2.3:o:paloaltonetworks:pan-os::::::::

No data.

References

Link	Providers
https://security.paloaltonetworks.com/CVE-2020-1975

History

No history.

MITRE

Status: PUBLISHED

Assigner: palo_alto

Published: 2020-02-12T22:57:08.099602Z

Updated: 2024-09-16T18:23:27.053Z

Reserved: 2019-12-04T00:00:00

Link: CVE-2020-1975

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2020-02-12T23:15:11.390

Modified: 2020-02-18T20:10:07.483

Link: CVE-2020-1975

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "PAN-OS", "vendor": "Palo Alto Networks", "versions": [{"status": "unaffected", "version": "7.1.*"}, {"status": "unaffected", "version": "8.0.*"}, {"changes": [{"at": "8.1.12", "status": "unaffected"}], "lessThan": "8.1.12", "status": "affected", "version": "8.1", "versionType": "custom"}, {"changes": [{"at": "9.0.6", "status": "unaffected"}], "lessThan": "9.0.6", "status": "affected", "version": "9.0", "versionType": "custom"}]}], "configurations": [{"lang": "en", "value": "This issue requires that the web-based management interface is enabled on the hardware or virtual appliance."}], "credits": [{"lang": "en", "value": "This issue was found during a security assessment performed by a customer."}], "datePublic": "2020-02-12T00:00:00", "descriptions": [{"lang": "en", "value": "Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-112", "description": "CWE-112 Missing XML Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-02-12T22:57:08", "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://security.paloaltonetworks.com/CVE-2020-1975"}], "solutions": [{"lang": "en", "value": "This issue is fixed in PAN-OS 8.1.12, PAN-OS 9.0.6, and all later versions."}], "source": {"defect": ["PAN-124593"], "discovery": "EXTERNAL"}, "title": "Missing XML Validation in PAN-OS Web Interface", "workarounds": [{"lang": "en", "value": "This issue affects the web-based management interface of the appliance. Access to the web-based management interface of the appliance should be limited strictly to only trusted users, hosts, and networks."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@paloaltonetworks.com", "DATE_PUBLIC": "2020-02-12T17:00:00.000Z", "ID": "CVE-2020-1975", "STATE": "PUBLIC", "TITLE": "Missing XML Validation in PAN-OS Web Interface"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "PAN-OS", "version": {"version_data": [{"version_affected": "!", "version_name": "7.1", "version_value": "7.1.*"}, {"version_affected": "!", "version_name": "8.0", "version_value": "8.0.*"}, {"version_affected": "<", "version_name": "8.1", "version_value": "8.1.12"}, {"version_affected": "<", "version_name": "9.0", "version_value": "9.0.6"}, {"version_affected": "!>=", "version_name": "8.1", "version_value": "8.1.12"}, {"version_affected": "!>=", "version_name": "9.0", "version_value": "9.0.6"}]}}]}, "vendor_name": "Palo Alto Networks"}]}}, "configuration": [{"lang": "en", "value": "This issue requires that the web-based management interface is enabled on the hardware or virtual appliance."}], "credit": [{"lang": "eng", "value": "This issue was found during a security assessment performed by a customer."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-112 Missing XML Validation"}]}]}, "references": {"reference_data": [{"name": "https://security.paloaltonetworks.com/CVE-2020-1975", "refsource": "MISC", "url": "https://security.paloaltonetworks.com/CVE-2020-1975"}]}, "solution": [{"lang": "en", "value": "This issue is fixed in PAN-OS 8.1.12, PAN-OS 9.0.6, and all later versions."}], "source": {"defect": ["PAN-124593"], "discovery": "EXTERNAL"}, "work_around": [{"lang": "en", "value": "This issue affects the web-based management interface of the appliance. Access to the web-based management interface of the appliance should be limited strictly to only trusted users, hosts, and networks."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T06:54:00.317Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://security.paloaltonetworks.com/CVE-2020-1975"}]}]}, "cveMetadata": {"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "assignerShortName": "palo_alto", "cveId": "CVE-2020-1975", "datePublished": "2020-02-12T22:57:08.099602Z", "dateReserved": "2019-12-04T00:00:00", "dateUpdated": "2024-09-16T18:23:27.053Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*", "matchCriteriaId": "2CC7A3CD-536E-4B51-A3C1-9C358746CA4D", "versionEndExcluding": "8.1.12", "versionStartIncluding": "8.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*", "matchCriteriaId": "B6B860AF-A793-4ED4-8D35-1D69E2F16A3E", "versionEndExcluding": "9.0.6", "versionStartIncluding": "9.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de falta de comprobaci\u00f3n XML en la interfaz web PAN-OS en el software Palo Alto Networks PAN-OS, permite a usuarios autenticados inyectar XML arbitrario que resulta en una escalada de privilegios. Este problema afecta a PAN-OS versiones 8.1 anteriores a PAN-OS 8.1.12 y PAN-OS versiones 9.0 anteriores a PAN-OS 9.0.6. Este problema no afecta a PAN-OS versi\u00f3n 7.1, PAN-OS versi\u00f3n 8.0 o PAN-OS versi\u00f3n 9.1 o posteriores."}], "id": "CVE-2020-1975", "lastModified": "2020-02-18T20:10:07.483", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "psirt@paloaltonetworks.com", "type": "Secondary"}]}, "published": "2020-02-12T23:15:11.390", "references": [{"source": "psirt@paloaltonetworks.com", "tags": ["Vendor Advisory"], "url": "https://security.paloaltonetworks.com/CVE-2020-1975"}], "sourceIdentifier": "psirt@paloaltonetworks.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-112"}], "source": "psirt@paloaltonetworks.com", "type": "Secondary"}]}