CVE-2020-2008

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS allows authenticated administrators to execute code with root privileges or delete arbitrary system files and impact the system's integrity or cause a denial of service condition. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-73 CWE-78

Affected software

Vendor	Product	Versions
Palo Alto Networks	PAN-OS	8.0.; 7.1.; >= 8.1, < 8.1.14

References

https://security.paloaltonetworks.com/CVE-2020-2008Vendor Advisory
https://security.paloaltonetworks.com/CVE-2020-2008Vendor Advisory

Timeline

Published: May 13, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-20097.2An external control of filename vulnerability in the SD WAN component of Palo Alto Networks PAN-OS Panorama allows an authenticated administ CVE-2020-200929.8File Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by changing the Content-Type to image/jpeg and pla CVE-2020-200936.5The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messa CVE-2020-200946.5Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which re CVE-2020-200956.5iMessage (Messages app) iOS 12.4 and prior user interface does not properly represent URI messages to the user, which results in URI spoofin CVE-2020-200966.5Whatsapp iOS 2.19.80 and prior and Android 2.19.222 and prior user interface does not properly represent URI messages to the user, which res CVE-2020-20107.2An OS command injection vulnerability in PAN-OS management interface allows an authenticated administrator to execute arbitrary OS commands CVE-2020-20117.5An improper input validation vulnerability in the configuration daemon of Palo Alto Networks PAN-OS Panorama allows for a remote unauthentic CVE-2020-201185.5Buffer Overflow vulnerability in Avast AntiVirus before v.19.7 allows a local attacker to cause a denial of service via a crafted request to CVE-2020-20127.5Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote CVE-2020-201209.8ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" CVE-2020-201229.8Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in /coreframe/app/content/admin/content.php.