CVE-2020-1977

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Insufficient Cross-Site Request Forgery (XSRF) protection on Expedition Migration Tool allows remote unauthenticated attackers to hijack the authentication of administrators and to perform actions on the Expedition Migration Tool. This issue affects Expedition Migration Tool 1.1.51 and earlier versions.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Palo Alto Networks	Expedition	>= 1.1, <= 1.1.51

References

https://security.paloaltonetworks.com/CVE-2020-1977Vendor Advisory
https://www.tenable.com/security/research/tra-2020-11Third Party Advisory
https://security.paloaltonetworks.com/CVE-2020-1977Vendor Advisory
https://www.tenable.com/security/research/tra-2020-11Third Party Advisory

Timeline

Published: Feb 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-197705.4A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie CVE-2020-197789.8Incorrect Access Control in Shopxo v1.4.0 and v1.5.0 allows remote attackers to gain privileges in "/index.php" by manipulating the paramete CVE-2020-19784.4TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability (HA) in CVE-2020-197868.8File upload vulnerability in CSKaza CSZ CMS v.1.2.2 fixed in v1.2.4 allows attacker to execute aritrary commands and code via crafted PHP fi CVE-2020-19797.8A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network based attacker with knowledge of registered firew CVE-2020-19807.8A shell command injection vulnerability in the PAN-OS CLI allows a local authenticated user to escape the restricted shell and escalate priv CVE-2020-198029.8File Upload vulnerability found in Milken DoyoCMS v.2.3 allows a remote attacker to execute arbitrary code via the upload file type paramete CVE-2020-198038.8Cross Site Request Forgery vulnerability found in Milken DoyoCMS v.2.3 allows a remote attacker to execute arbitrary code via the background CVE-2020-19817.8A predictable temporary filename vulnerability in PAN-OS allows local privilege escalation. This issue allows a local attacker who bypassed CVE-2020-19824.8Certain communication between PAN-OS and cloud-delivered services inadvertently use TLS 1.0, which is known to be a cryptographically weak p CVE-2020-198218.8A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders[] parameter.CVE-2020-198227.2A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via th