PT-2020-3484 · Palo Alto Networks · Pan-Os

Published 2020-05-13 · Updated 2020-05-18 · CVE-2020-1997

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 7.1 earlier than 7.1.26 Palo Alto Networks PAN-OS versions 8.0 earlier than 8.0.14

Description An open redirection vulnerability in the GlobalProtect component allows an attacker to specify an arbitrary redirection target away from the trusted GlobalProtect gateway. If the user then successfully authenticates, it will cause them to access an unexpected and potentially malicious website.

Recommendations For PAN-OS 7.1 versions earlier than 7.1.26, update to version 7.1.26 or later. For PAN-OS 8.0 versions earlier than 8.0.14, update to version 8.0.14 or later.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2020-03808

CVE-2020-1997

Affected Products

Pan-Os

References · 5

• https://security.paloaltonetworks.com/CVE-2020-1997 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1997 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1997 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03808 · Security Note
• https://t.me/cvenotify/3761 · Telegram Post