CVE-2020-2036 HIGH

CVE-2020-2036: PAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interface

Vendor Palo Alto Networks
Product PAN-OS
Weakness CWE-79 · XSS
Published September 9, 2020
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute arbitrary JavaScript code in the administrator's browser and perform administrative actions. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9.

Key dates

02Disclosure timeline

September 9, 2020 CVE published
September 16, 2024 Record updated