CVE-2020-2021 PAN-OS: Authentication Bypass in SAML Authentication

🗓️ 29 Jun 2020 15:10:11Reported by palo_altoType

Authentication Bypass in SAML Authentication enables unauthenticated network-based attacker access to protected resource

Reporter	Title	Published	Views	Family All 25
GithubExploit	Exploit for Improper Verification of Cryptographic Signature in Paloaltonetworks Pan-Os	29 Jun 202016:56	–	githubexploit
ICS	APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations	24 Oct 202012:00	–	ics
ATTACKERKB	CVE-2020-2034 — PAN-OS: OS command injection vulnerability in GlobalProtect portal	8 Jul 202000:00	–	attackerkb
ATTACKERKB	CVE-2020-1472 aka Zerologon	17 Aug 202000:00	–	attackerkb
ATTACKERKB	CVE-2020-2021 PAN-OS: Authentication Bypass in SAML Authentication	29 Jun 202000:00	–	attackerkb
BDU FSTEC	The vulnerability of the Security Assertion Markup Language (SAML) implementation in the PAN-OS operating system allows a perpetrator to increase their privileges.	11 Aug 202000:00	–	bdu_fstec
Circl	CVE-2020-2021	29 Jun 202018:16	–	circl
CISA KEV Catalog	Palo Alto Networks PAN-OS Authentication Bypass Vulnerability	25 Mar 202200:00	–	cisa_kev
CISA	Palo Alto Releases Security Updates for PAN-OS	29 Jun 202000:00	–	cisa
CNVD	Palo Alto Networks PAN-OS Data Forgery Issue Vulnerability	30 Jun 202000:00	–	cnvd

[
  {
    "product": "PAN-OS",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "unaffected",
        "version": "7.1.*"
      },
      {
        "status": "affected",
        "version": "8.0.*"
      },
      {
        "changes": [
          {
            "at": "8.1.15",
            "status": "unaffected"
          }
        ],
        "lessThan": "8.1.15",
        "status": "affected",
        "version": "8.1",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "9.0.9",
            "status": "unaffected"
          }
        ],
        "lessThan": "9.0.9",
        "status": "affected",
        "version": "9.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "9.1.3",
            "status": "unaffected"
          }
        ],
        "lessThan": "9.1.3",
        "status": "affected",
        "version": "9.1",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
security	www.security.paloaltonetworks.com/CVE-2020-2021

29 Jun 2020 15:10Current

9.5High risk

Vulners AI Score9.5

CVSS 3.110

EPSS0.03994

CWE-347