CVE-2020-1997

PAN-OS: GlobalProtect registration open redirect

En bref

Sévérité: MEDIUM 5.3
EPSS: EPSS 0.92 % · centile 60 (2026-10-27)
État: PUBLISHED
Publiée: 2020-05-13
Mise à jour: 2024-09-16
Attribuée par: palo_alto
Statut NVD: Modified

Description

An open redirection vulnerability in the GlobalProtect component of Palo Alto Networks PAN-OS allows an attacker to specify an arbitrary redirection target away from the trusted GlobalProtect gateway. If the user then successfully authenticates it will cause them to access an unexpected and potentially malicious website. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.0 versions earlier than 8.0.14.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	palo_alto
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	NVD · psirt@paloaltonetworks.com (Secondary)
CVSS 3.1	MEDIUM 6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 5.8	AV:N/AC:M/Au:N/C:P/I:P/A:N	NVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

CWE-601

Références européennes

ENISA EUVD · EUVD-2020-12787
GCVE · GCVE-0-2020-1997

Avis du CERT-FR

CERTFR-2020-AVI-290 — Multiples vulnérabilités dans Palo Alto PAN-OS et GlobalProtect · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 7.1.0 < 7.1.26
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 8.0.0 < 8.0.14

Produits affectés

Produit	Versions
Palo Alto Networks · PAN-OS	unaffected 8.1.* ; unaffected 9.0.* ; unaffected 9.1.* ; affected 7.1 < 7.1.26 ; affected 8.0 < 8.0.14

Références

https://security.paloaltonetworks.com/CVE-2020-1997

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD