CVE-2020-2039

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted after the request is finished. It is possible for an attacker to disrupt the availability of the management web interface by repeatedly uploading files until available disk space is exhausted. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-203915.4Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via (1) Add Snippet and (2) Save snippets.CVE-2020-203929.8SQL Injection vulnerability in imcat v5.2 via the fm[auser] parameters in coms/add_coms.php.CVE-2020-20409.8A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary c CVE-2020-204027.5Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation.CVE-2020-204065.4A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions CVE-2020-20417.5An insecure configuration of the appweb daemon of Palo Alto Networks PAN-OS 8.1 allows a remote unauthenticated user to send a specifically CVE-2020-204126.5lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient array bounds checking via a craft CVE-2020-204139.8SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in ad CVE-2020-20427.2A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and p CVE-2020-204256.1S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function.CVE-2020-204266.1S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave.php.CVE-2020-20433.3An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo