CVE-2020-2017: 
PAN-OS vulnerability analysis and mitigation

A DOM-Based Cross Site Scripting (XSS) vulnerability was discovered in PAN-OS and Panorama Management Web Interfaces, identified as CVE-2020-2017. The vulnerability was discovered internally by Chris Ganas of Palo Alto Networks and disclosed on May 13, 2020. This vulnerability affects multiple versions of PAN-OS including versions earlier than 7.1.26, 8.1.13, and 9.0.6 (Palo Alto Advisory).

The vulnerability has been assigned a CVSSv3.1 Base Score of 8.8 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-79 Cross-site Scripting (XSS). A remote attacker could execute arbitrary JavaScript code in the administrator's browser by convincing an authenticated administrator to click on a crafted link to PAN-OS and Panorama Web Interfaces (Palo Alto Advisory).

If successfully exploited, this vulnerability allows attackers to perform administrative actions through the execution of arbitrary JavaScript code in the administrator's browser. The high CVSS score indicates severe potential impacts on confidentiality, integrity, and availability of the system (Palo Alto Advisory).

The vulnerability requires network access and user interaction for successful exploitation. While the attack complexity is considered low, it requires an authenticated administrator to click on a crafted link. No privileges are required for the attacker to initiate the attack (Palo Alto Advisory).

The vulnerability has been fixed in PAN-OS versions 7.1.26, 8.1.13, 9.0.6, 9.1.0, and all later versions. For affected systems, Palo Alto Networks recommends following best practices for securing the PAN-OS management interface, which significantly mitigates this issue. Detailed guidance is available in the Best Practices for Securing Administrative Access in the PAN-OS technical documentation (Palo Alto Advisory).