Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2022-0017

GlobalProtect App: Improper Link Resolution Vulnerability Leads to Local Privilege Escalation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
palo_alto

Description

An improper link resolution before file access ('link following') vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a local attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges under certain circumstances. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.10 on Windows. GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.5 on Windows. This issue does not affect GlobalProtect app on other platforms.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palo Alto Networks GlobalProtect App

  • 5.2 to < 5.2.5affected
  • 5.1 to < 5.1.10affected

Palo Alto Networks GlobalProtect App

  • 5.3.*unaffected

References