CVE-2020-1975

MEDIUM

PAN-OS 8.1.0-8.1.11 - Authenticated XML External Entity Injection in Web Interface

Title source: llm
STIX 2.1

Description

Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_misc
https://security.paloaltonetworks.com/CVE-2020-1975

Scores

CVSS v3 6.8
EPSS 0.0037
EPSS Percentile 58.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-611 CWE-112
Status published
Products (1)
paloaltonetworks/pan-os 8.1.0 - 8.1.12
Published Feb 12, 2020
Tracked Since Feb 18, 2026