// For flags

CVE-2020-2050

PAN-OS: Authentication bypass vulnerability in GlobalProtect SSL VPN client certificate verification

Severity Score

8.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenticate as any user and gain access to restricted VPN network resources when the gateway or portal is configured to rely entirely on certificate-based authentication. Impacted features that use SSL VPN with client certificate verification are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN In configurations where client certificate verification is used in conjunction with other authentication methods, the protections added by the certificate check are ignored as a result of this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.

Se presenta una vulnerabilidad de omisión de autenticación en el componente GlobalProtect SSL VPN del software PAN-OS de Palo Alto Networks, que permite a un atacante omitir todas las comprobaciones de certificados de clientes con un certificado no válido. Un atacante remoto puede autenticarse con éxito como cualquier usuario y conseguir acceso a los recursos de red VPN restringidos cuando la puerta de enlace o el portal están configurados para depender completamente de la autenticación basada en certificados. Las características afectadas que usan SSL VPN con verificación de certificado de cliente son: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN. En configuraciones donde la verificación de certificado de cliente es usada en conjunto con otros métodos de autenticación, las protecciones agregadas por la verificación de certificado son ignoradas como resultado de este problema. Este problema afecta: versiones PAN-OS 8.1 anteriores a PAN-OS 8.1.17; versiones PAN-OS 9.0 anteriores a PAN-OS 9.0.11; versiones PAN-OS 9.1 anteriores a PAN-OS 9.1.5; versiones PAN-OS 10.0 anteriores a PAN-OS 10.0.1

*Credits: This issue was found by Nicholas Newsom of Palo Alto Networks during internal security review.
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-12-04 CVE Reserved
  • 2020-11-12 CVE Published
  • 2024-07-29 EPSS Updated
  • 2024-09-17 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-285: Improper Authorization
  • CWE-287: Improper Authentication
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Paloaltonetworks
Search vendor "Paloaltonetworks"
Pan-os
Search vendor "Paloaltonetworks" for product "Pan-os"
>= 8.1.0 < 8.1.17
Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 8.1.0 < 8.1.17"
-
Affected
Paloaltonetworks
Search vendor "Paloaltonetworks"
Pan-os
Search vendor "Paloaltonetworks" for product "Pan-os"
>= 9.0.0 < 9.0.11
Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 9.0.0 < 9.0.11"
-
Affected
Paloaltonetworks
Search vendor "Paloaltonetworks"
Pan-os
Search vendor "Paloaltonetworks" for product "Pan-os"
>= 9.1.0 < 9.1.5
Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 9.1.0 < 9.1.5"
-
Affected
Paloaltonetworks
Search vendor "Paloaltonetworks"
Pan-os
Search vendor "Paloaltonetworks" for product "Pan-os"
>= 10.0.0 < 10.0.1
Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 10.0.0 < 10.0.1"
-
Affected