Skip to content
OpenAdvisories
Medium · 6.8 CVE-2020-1975 EUVD-2020-12765GHSA-m6cf-g9vq-wjwm

Missing XML Validation in PAN-OS Web Interface

Published Feb 12, 2020 · Updated Sep 16, 2024 · Assigned by palo_alto

Vendor: Palo Alto Networks Product: PAN-OS Category: Network devices

Description

Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions.

Affected products

VendorProductAffectedFixed
Palo Alto Networks PAN-OS 8.1 – < 8.1.12, 9.0 – < 9.0.6 7.1.*

References