Resource exhaustion in Palo Alto Networks Pan-Os
CVE-2020-2039
An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted after the request is finished. It is possible for an attacker to disrupt the availability of the management web interface by repeatedly uploading files until available disk space is exhausted. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.464 (98.8th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 99th percentile — 98.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.464 · newest: 0.464 · change: 0.000
Affected products
- Palo Alto Networks Pan-Os — versions 9.1, 8.1, 9.0
- Paloaltonetworks Pan-Os
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security.paloaltonetworks.com/CVE-2020-2039 (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-2039?
- CVE-2020-2039 is a medium-severity vulnerability in Palo Alto Networks Pan-Os, classified under Uncontrolled Resource Consumption. CVSS score: 5.3/10. Published 2020-09-09.
- How severe is CVE-2020-2039?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2020-2039 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.