CVE-2020-2038 – PAN-OS: OS command injection vulnerability in the management web interface

https://notcve.org/view.php?id=CVE-2020-2038

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlier than 10.0.1. Una vulnerabilidad de Inyección de Comandos del Sistema Operativo en la interfaz de administración de PAN-OS que permite a los administradores autenticados ejecutar comandos de Sistema Operativo arbitrarios con privilegios root. Este problema impacta a: Versiones PAN-OS 9.0 anteriores a 9.0.10; Versiones PAN-OS 9.1 anteriores a 9.1.4; Versiones PAN-OS 10.0 anteriores a 10.0.1. PAN-OS version 10.0 suffers from a remote code execution vulnerability. • https://www.exploit-db.com/exploits/51005 https://github.com/und3sc0n0c1d0/CVE-2020-2038 http://packetstormsecurity.com/files/168008/PAN-OS-10.0-Remote-Code-Execution.html http://packetstormsecurity.com/files/168408/Palo-Alto-Networks-Authenticated-Remote-Code-Execution.html https://security.paloaltonetworks.com/CVE-2020-2038 https://swarm.ptsecurity.com/swarm-of-palo-alto-pan-os-vulnerabilities • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •