CVE-2020-2003

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An external control of filename vulnerability in the command processing of PAN-OS allows an authenticated administrator to delete arbitrary system files affecting the integrity of the system or causing denial of service to all PAN-OS services. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions before 8.1.14; PAN-OS 9.0 versions before 9.0.7; PAN-OS 9.1 versions before 9.1.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-20045.5Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troub CVE-2020-20056.1A cross-site scripting (XSS) vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN CVE-2020-20068.8A stack-based buffer overflow vulnerability in the management server component of PAN-OS that allows an authenticated user to potentially ex CVE-2020-200678.8File upload vulnerability in ebCMS v.1.1.0 allows a remote attacker to execute arbitrary code via the upload type parameter.CVE-2020-20077.2An OS command injection vulnerability in the management server component of PAN-OS allows an authenticated user to potentially execute arbit CVE-2020-200706.1Cross Site Scripting vulnerability found in wkeyuan DWSurvey 1.0 allows a remote attacker to execute arbitrary code via thequltemld paramete CVE-2020-20087.2An OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS allows authenticated administrators to e CVE-2020-20097.2An external control of filename vulnerability in the SD WAN component of Palo Alto Networks PAN-OS Panorama allows an authenticated administ CVE-2020-200929.8File Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by changing the Content-Type to image/jpeg and pla CVE-2020-200936.5The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messa CVE-2020-200946.5Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which re CVE-2020-200956.5iMessage (Messages app) iOS 12.4 and prior user interface does not properly represent URI messages to the user, which results in URI spoofin