PT-2020-3956

CVE-2020-2036

Published

2020-09-09

Updated

2021-02-12

Description by

CVSS 2.0

High

MetricsAV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: PAN-OS versions earlier than 8.1.16 PAN-OS versions earlier than 9.0.9

Description: A reflected cross-site scripting (XSS) issue exists in the PAN-OS management web interface. This could allow a remote attacker to execute arbitrary JavaScript code in an administrator's browser and perform administrative actions if the administrator clicks on a crafted link. The issue is related to insufficient input validation.

Recommendations: For PAN-OS versions earlier than 8.1.16, update to version 8.1.16 or later. For PAN-OS versions earlier than 9.0.9, update to version 9.0.9 or later.

Exploitability

Fix

Impacts

Researchers

Ben Nott

Mikhail Klyuchnikov

Nikita Abramov

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers