CVE-2020-1975: Missing XML Validation in PAN-OS Web Interface
Vulnerability summary
CVE-2020-1975 is a high (CVSS 8.8) Missing XML Validation vulnerability in palo alto networks pan-os. EPSS estimates a 1.00% chance of exploitation in the next 30 days, higher than 62.4% of scored vulnerabilities.
Timeline
- 12-02-2020PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA6.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
1.00%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.00% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-112Missing XML ValidationThe product accepts XML from an untrusted source but does not validate the XML against the proper schema.
- CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Affected systems
Palo alto networks1 product
- pan-os≥ 8.1, < 8.1.12 | ≥ 9.0, < 9.0.6
Paloaltonetworks1 product
- pan-os≥ 8.1.0, < 8.1.12 | ≥ 9.0.0, < 9.0.6
2 vendors · 2 products