CVE-2020-2005: 
PAN-OS vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability (CVE-2020-2005) was identified in the Palo Alto Networks GlobalProtect Clientless VPN that could compromise a user's active session when visiting malicious websites. The vulnerability affects multiple versions of PAN-OS including versions earlier than 7.1.26, 8.1.13, 9.0.7, and all versions of PAN-OS 8.0. This high-severity vulnerability was disclosed on May 13, 2020, with a CVSS score of 7.1 (Palo Security).

The vulnerability is classified as a cross-site scripting (XSS) issue with a CVSS v3.1 Base Score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N). The attack vector is network-based with low attack complexity, requires no privileges, but does need user interaction. The scope is unchanged, with high confidentiality impact, low integrity impact, and no availability impact. The weakness type is categorized as CWE-79 Cross-site Scripting (XSS) (Palo Security).

The vulnerability can lead to the compromise of a user's active GlobalProtect Clientless VPN session when visiting malicious websites. This could potentially allow attackers to gain unauthorized access to the user's VPN session and associated resources (Palo Security).

The vulnerability requires user interaction and is exploitable when users visit malicious websites while using the GlobalProtect Clientless VPN. The issue only affects firewalls configured with GlobalProtect Clientless VPN (Palo Security).

The vulnerability has been fixed in PAN-OS versions 7.1.26, 8.1.13, 9.0.7, and all later versions. For systems that cannot be immediately updated, Palo Alto Networks recommends configuring GlobalProtect Clientless VPN to only access known trusted websites and block access to all other websites (Palo Security).