CVE-2020-2022 PAN-OS: Panorama session disclosure during context switch into managed device

High 7.5 Published 12 Nov 2020 Updated 16 Sep 2024

Attackers can steal Panorama admin session tokens during context switches to gain privileged access to the management interface.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2020-2022?

CVE-2020-2022 is a high-severity vulnerability in Paloaltonetworks Pan-Os, published on 12 Nov 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the token for the Panorama web interface administrator's session to a managed device when the Panorama administrator performs a context switch into that device. This vulnerability allows an attacker to gain privileged access to the Panorama web interface. An attacker requires some knowledge of managed firewalls to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5.

Weakness: CWE-269, CWE-200

Which versions are affected by CVE-2020-2022?

It affects 1 product.

Products include Paloaltonetworks Pan-Os.

How do I fix CVE-2020-2022?

No fix has been published for CVE-2020-2022 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-2022 being exploited?

There is no known exploitation of CVE-2020-2022 in the wild and no public exploit code.

All Paloaltonetworks Pan-Os vulnerabilities

Sources

Also known as GHSA-ph28-25q8-724q.