CVE-2024-5921

Katalog CVE

CVSS 8.8 · High EPSS 1,5%

Kerentanan Improper Certificate Validation pada paloaltonetworks globalprotect. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint. Please subscribe to our RSS feed https://security.paloaltonetworks.com/rss.xml to be alerted to new updates to this and other advisories.

Rincian

Terbit di NVD

27 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 72,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.paloaltonetworks.com/CVE-2024-5921 advisory vendor
• https://blog.amberwolf.com/blog/2024/november/palo-alto-globalprotect---code-execution-and-privilege-escalatio... exploit · deskripsi teknis · advisory pihak ketiga
• https://github.com/AmberWolfCyber/NachoVPN not applicable