CVE-2020-1996CWE-862

PAN-OS: Panorama management server log injection

Medium · published May 13, 2020

CVSS v3.1
5.3
EPSS
1%
Percentile
59.5
In the wild
Unconfirmed
What it is

A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthenticated user to inject messages into the management server ms.log file. This vulnerability can be leveraged to obfuscate an ongoing attack or fabricate log entries in the ms.log file This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.9.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00905 · 59.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2020-05-13T19:07Z
EPSS history
Timeline
  • 13 MAY 19:07Z
    PAN-OS: Panorama management server log injection
    cvelistv5