HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsAEI IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / Enrich
DocsBlog

CVE report

CVE-2020-2036high

Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting

Events 90d

68,791

Distinct IPs

343

Severity

high

CISA KEV

Not listed

Detection signature

An event counts toward CVE-2020-2036 when its URL path contains any of these (case-insensitive). This is what our matching is based on.

  • · /unauth/php/change_password.php/%22%3E%3Csvg%2Fonload%3Dalert(document.domain)%3E
  • · /php/change_password.php/%22%3E%3Csvg%2Fonload%3Dalert(document.domain)%3E
  • · /_404_/%22%3E%3Csvg%2Fonload%3Dalert(document.domain)%3E
  • · /global-protect/login.esp

Pre-disclosure activity

all early actors →

Analysing probe history around the publication date…

Recent probe volume (last 7 days)

peak: 2,467 events/day
05-0205-2906-0906-2007-0107-1207-2307-27
eventsdistinct IPs

Downloads & integrations

CSV (source IPs)JSONSave as feed

Top sources probing for CVE-2020-2036

Top networks the attempts come from

Fingerprints of the clients exploiting this

The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.

ja4h: po11nn19en_317963a85131ja4h: ge11nn0400_11975a10f91bja4h: ge11nn0300_dedeb29cc523ja4h: ge11nn07en_c3e833da1ad8ja4h: po11nn0600_da06d4cb66f4ja4h: ge11nn0400_ef4d07580f66ja4: t13i131300_f57a46bbacb6_3b244d8fbcc8ja4: t13i3112h1_e8f1e7e78f70_d339722ba4afja4: t13i181100_e8a523a41297_02c8e53ee398ja4: t13i180900_e8a523a41297_78e6aca7449bja4: t13i131000_f57a46bbacb6_ab7e3b40a677

Sample request paths observed

  • /global-protect/login.esp
  • /tcp/global-protect/login.esp
  • //global-protect/login.esp