CVE-2020-2050

PAN-OS: Authentication bypass vulnerability in GlobalProtect SSL VPN client certificate verification

State: Published
Severity: 8.2 High
Published: Nov 12, 2020
Updated: Sep 17, 2024
Reserved: Dec 4, 2019

Description

An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenticate as any user and gain access to restricted VPN network resources when the gateway or portal is configured to rely entirely on certificate-based authentication. Impacted features that use SSL VPN with client certificate verification are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN In configurations where client certificate verification is used in conjunction with other authentication methods, the protections added by the certificate check are ignored as a result of this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N	palo_alto

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
PAN-OSPalo Alto Networks	8.1 to before 8.1.17Affectedfrom 8.1.17Not affected 9.0 to before 9.0.11Affectedfrom 9.0.11Not affected 9.1 to before 9.1.5Affectedfrom 9.1.5Not affected 10.0 to before 10.0.1Affectedfrom 10.0.1Not affected

References

https://security.paloaltonetworks.com/CVE-2020-2050

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.