CVE-2020-2048: 
PAN-OS vulnerability analysis and mitigation

An information exposure through log file vulnerability (CVE-2020-2048) was discovered in Palo Alto Networks PAN-OS software where the password for the configured system proxy server may be displayed in cleartext when using the CLI. This vulnerability affects PAN-OS versions 8.1 (earlier than 8.1.17), 9.0 (earlier than 9.0.11), and 9.1 (earlier than 9.1.2). The vulnerability was discovered in production use and was disclosed on November 11, 2020 (Palo Alto Networks).

The vulnerability has been assigned a CVSSv3.1 Base Score of 3.3 (LOW) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability type is classified as CWE-532 (Information Exposure Through Log Files). This issue is only applicable when a system proxy server is configured on the firewall, which can be verified in the management web interface under Setup -> Services -> Proxy Server (Palo Alto Networks).

The vulnerability could lead to exposure of sensitive information, specifically the system proxy server password, through log files when using the CLI in PAN-OS appliances. The impact is limited to confidentiality with no effect on system integrity or availability (Palo Alto Networks).

Palo Alto Networks has reported that they are not aware of any malicious exploitation of this vulnerability in the wild (Palo Alto Networks).

The vulnerability has been fixed in PAN-OS versions 8.1.17, 9.0.11, 9.1.2, and all later PAN-OS versions. As a workaround, users can mitigate the impact by following best practices for securing the management web interface, which are detailed in the Best Practices for Securing Administrative Access in the PAN-OS technical documentation (Palo Alto Networks).