CVEs-PoC/2020/CVE-2020-2036.md

### [CVE-2020-2036](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2036)
![](https://img.shields.io/static/v1?label=Product&message=PAN-OS&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=9.0%3C%209.0.9%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-site%20Scripting%20(XSS)&color=brighgreen)

### Description

A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute arbitrary JavaScript code in the administrator's browser and perform administrative actions. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9.

### POC

#### Reference
- https://security.paloaltonetworks.com/CVE-2020-2036

#### Github
- https://github.com/404notf0und/CVE-Flow
- https://github.com/ARPSyndicate/kenzer-templates
- https://github.com/Elsfa7-110/kenzer-templates