CVE-2024-5921

GlobalProtect App: Insufficient Certificate Validation Leads to Privilege Escalation

State: Published
Severity: 6.0 Medium
Published: Nov 27, 2024
Updated: Feb 20, 2025
Reserved: Jun 12, 2024

Description

An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.

Please subscribe to our RSS feed https://security.paloaltonetworks.com/rss.xml to be alerted to new updates to this and other advisories.

Scores

CVSS	Score	Vector	Source
4.0	6.0 Medium	CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/AU:N/R:U/V:D/RE:M/U:Amber	palo_alto
4.0	7.1 High	CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/AU:N/R:U/V:D/RE:M/U:Amber	palo_alto

Weaknesses

CWE-295 Improper Certificate Validation

Affected Products

Product	Versions
GlobalProtect AppPalo Alto Networks	6.3.0 to before 6.3.2Affectedfrom 6.3.2Not affected 6.2.0 to before 6.2.6Affectedfrom 6.2.6Not affected 6.1.0Affected
GlobalProtect AppPalo Alto Networks	6.3.0 to before 6.3.2Affectedfrom 6.3.2Not affected 6.2.0 to before 6.2.6-c857Affectedfrom 6.2.6-c857Not affected 6.1.0Affected
GlobalProtect AppPalo Alto Networks	6.2.0 to before 6.2.1-c31Affectedfrom 6.2.1-c31Not affected 6.1.0Affected
GlobalProtect AppPalo Alto Networks	6.1.0 to before 6.1.6Affected
GlobalProtect AppPalo Alto Networks	6.1.0 to before 6.1.7Affectedfrom 6.1.7Not affected
GlobalProtect AppPalo Alto Networks	6.0.0Not affected 5.1.0Not affected
GlobalProtect AppPalo Alto Networks	6.2.0 to before 6.2.6Affectedfrom 6.2.6Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.