CVE-2020-1993: 
PAN-OS vulnerability analysis and mitigation

The GlobalProtect Portal feature in PAN-OS contains a session fixation vulnerability (CVE-2020-1993) that was disclosed on May 13, 2020. The vulnerability exists because the system does not set a new session identifier after a successful user login, which could allow session fixation attacks if an attacker is able to control a user's session ID. This vulnerability affects multiple versions of PAN-OS including all PAN-OS 7.1 and 8.0 versions, PAN-OS 8.1 versions earlier than 8.1.14, and PAN-OS 9.0 versions earlier than 9.0.8 (Palo Alto Networks).

The vulnerability has been assigned a CVSS v3.1 Base Score of 3.7 (LOW) with the following metrics: Attack Vector: NETWORK, Attack Complexity: HIGH, Privileges Required: LOW, User Interaction: REQUIRED, Scope: UNCHANGED, Confidentiality Impact: LOW, Integrity Impact: LOW, Availability Impact: NONE. The vulnerability is classified as CWE-384 Session Fixation (Palo Alto Networks).

If successfully exploited, this vulnerability could allow an attacker to perform session fixation attacks by controlling a user's session ID. This could potentially lead to unauthorized access to user sessions with low confidentiality and integrity impacts (Palo Alto Networks).

The vulnerability requires network access and user interaction for successful exploitation. The attack complexity is considered HIGH, and LOW privileges are required. There are no public reports of this vulnerability being exploited in the wild (Palo Alto Networks).

The vulnerability has been fixed in PAN-OS versions 8.1.14, 9.0.8, 9.1.0, and all later PAN-OS versions. PAN-OS 8.0 is end-of-life as of October 31, 2019, and is no longer covered by Product Security Assurance policies. PAN-OS 7.1 is on extended support until June 30, 2020. There are no known workarounds for this issue (Palo Alto Networks).