CVE-2020-2034

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect portal feature is not enabled. This issue impacts PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; all versions of PAN-OS 8.0 and PAN-OS 7.1. Prisma Access services are not impacted by this vulnerability.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-203407.5A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0 allows attackers to access sensitive database infor CVE-2020-203417.5YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function.CVE-2020-203436.5WTCMS 1.0 contains a cross-site request forgery (CSRF) vulnerability in the index.php?g=admin&m=nav&a=add_post component that allows attacke CVE-2020-203445.4WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the keyword search function under the background articles module CVE-2020-203455.4WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the page management background which allows attackers to obtain CVE-2020-203475.4WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the source field under the article management module.CVE-2020-203485.4WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link field under the background menu management module.CVE-2020-203495.4WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link address field under the background links module.CVE-2020-20353.0When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects th CVE-2020-20368.8A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an ad CVE-2020-203634.8Crossi Site Scripting (XSS) vulnerability in PbootCMS 2.0.3 in admin.php.CVE-2020-20377.2An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS co