CVE-2020-1988 — Unquoted Search Path or Element in Palo Alto Networks Global Protect Agent
Severity
6.7MEDIUMNVD
CNA4.2
EPSS
0.1%
top 67.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 8
Latest updateMay 24
Description
An unquoted search path vulnerability in the Windows release of Global Protect Agent allows an authenticated local user with file creation privileges on the root of the OS disk (C:\) or to Program Files directory to gain system privileges. This issue affects Palo Alto Networks GlobalProtect Agent 5.0 versions before 5.0.5; 4.1 versions before 4.1.13 on Windows;
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9
Affected Packages3 packages
🔴Vulnerability Details
2📋Vendor Advisories
1Palo Alto▶
GlobalProtect App: Local privilege escalation due to an unquoted search path vulnerability↗2020-04-08