CVE-2020-2048
PAN-OS: System proxy passwords may be logged in clear text while viewing system state
- Published
- Updated
- Reserved
- Assigned by
- palo_alto
Description
An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed in cleartext when using the CLI in Palo Alto Networks PAN-OS software. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.2.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| palo_altoCNA (assigner) | 3.1 | Low3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVDNVD · Modified | 3.1 | Low3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.34% · top 72% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.3.
Weakness
Affected products
- unaffected 10.0.*
- affected 8.1 – < 8.1.17
- affected 9.0 – < 9.0.11
- affected 9.1 – < 9.1.2
What to do
Solution: This issue is fixed in PAN-OS 8.1.17, PAN-OS 9.0.11, PAN-OS 9.1.2, and all later PAN-OS versions.
Workaround: This issue impacts the management web interface. You can mitigate the impact of this issue by following best practices for securing the interface. Please review the Best Practices for Securing Administrative Access in the PAN-OS technical documentation, available at https://docs.paloaltonetworks.com/best-practices.
Exploitation: Palo Alto Networks is not aware of any malicious exploitation of this issue.
References (1)
- https://security.paloaltonetworks.com/CVE-2020-2048 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2020-2048)Record last updated .