Resource exhaustion in Palo Alto Networks Pan-Os
CVE-2020-2039
An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted after the request is finished. It is possible for an attacker to disrupt the availability of the management web interface by repeatedly uploading files until available disk space is exhausted. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.464 (98.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Palo Alto Networks Pan-os — versions 9.1, 8.1, 9.0
- Paloaltonetworks Pan-os
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@paloaltonetworks.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-2039?
- CVE-2020-2039 is a medium-severity vulnerability in Palo Alto Networks Pan-Os, classified under Uncontrolled Resource Consumption. CVSS score: 5.3/10. Published 2020-09-09.
- How severe is CVE-2020-2039?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2020-2039 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.