CVE-2020-1987lowCWE-200

CVE-2020-1987: low-severity vulnerability in Palo Alto Networks Global Protect Agent

Global Protect Agent: VPN cookie local information disclosure

Published · Updated

Follow this CVE+ Monitor Global Protect Agent

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.9epss 0.3%
An information exposure vulnerability in the logging component of Palo Alto Networks Global Protect Agent allows a local authenticated user to read VPN cookie information when the troubleshooting logging level is set to "Dump". This issue affects Palo Alto Networks Global Protect Agent 5.0 versions prior to 5.0.9; 5.1 versions prior to 5.1.1.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected products
Palo Alto Networks · Global Protect Agent
Related CVEs — Palo Alto Networks Global Protect Agent

In the same product, most dangerous first.

CVE-2020-1988MEDIUMGlobal Protect Agent: Local privilege escalation due to an unquoted search path vulnerabilityEPSS 0.4%CVE-2020-1989HIGHGlobal Protect Agent: Incorrect privilege assignment allows local privilege escalationEPSS 0.3%