Vulnerability in Palo Alto Networks Globalprotect App
CVE-2024-5921
An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint. Please subscribe to our RSS feed https://security.paloaltonetworks.com/rss.xml to be alerted to new updates to this and other advisories.
Vulnerability class: Improper Certificate Validation
EPSS: 0.015 (70.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Palo Alto Networks Globalprotect App — versions 6.3.0, 6.2.0, 6.1.0
- Paloaltonetworks Globalprotect
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@paloaltonetworks.com (vendor-advisory, Vendor Advisory)
- psirt@paloaltonetworks.com (Technical Description, Exploit, Third Party Advisory, exploit)
- psirt@paloaltonetworks.com (exploit, Not Applicable)
Frequently asked questions
- What is CVE-2024-5921?
- CVE-2024-5921 is a high-severity vulnerability in Palo Alto Networks Globalprotect App, classified under Improper Certificate Validation. CVSS score: 8.8/10. Published 2024-11-27.
- How severe is CVE-2024-5921?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2024-5921 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.