CVE-2020-1987
Last modified
CVE-2020-1987 is a low-severity vulnerability rated 3.3/10 on the CVSS scale. An information exposure vulnerability in the logging component of Palo Alto Networks Global Protect Agent allows a local authenticated user to read VPN cookie information when the troubleshooting logging level is set to "Dump". This issue affects Palo Alto Networks Global Protect Agent 5.0 versions prior to 5.0.9; 5.1 versions prior to 5.1.1.. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
An information exposure vulnerability in the logging component of Palo Alto Networks Global Protect Agent allows a local authenticated user to read VPN cookie information when the troubleshooting logging level is set to "Dump". This issue affects Palo Alto Networks Global Protect Agent 5.0 versions prior to 5.0.9; 5.1 versions prior to 5.1.1.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Paloaltonetworks | Globalprotect | >= 5.0, < 5.0.9 |
| Paloaltonetworks | Globalprotect | >= 5.1, < 5.1.1 |
References
- https://security.paloaltonetworks.com/CVE-2020-1987Vendor Advisory
- https://security.paloaltonetworks.com/CVE-2020-1987Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-1987?
How severe is CVE-2020-1987?
How do I fix CVE-2020-1987?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-19853BlueCMS v1.6 contains a SQL injection vulnerability via /ad_…9.8
- CVE-2020-19855phpwcms v1.9 contains a cross-site scripting (XSS) vulnerabi…6.1
- CVE-2020-19858Platinum Upnp SDK through 1.2.0 has a directory traversal vu…7.5
- CVE-2020-1986Improper input validation vulnerability in Secdo allows an a…5.5
- CVE-2020-19860When ldns version 1.7.1 verifies a zone file, the ldns_rr_ne…6.5
- CVE-2020-19861When a zone file in ldns 1.7.1 is parsed, the function ldns_…7.5
- CVE-2020-19877DBHcms v1.2.0 has a directory traversal vulnerability as the…5.3
- CVE-2020-19878DBHcms v1.2.0 has a sensitive information leaks vulnerabilit…7.5
- CVE-2020-19879DBHcms v1.2.0 has a stored xss vulnerability as there is no …6.1
- CVE-2020-1988An unquoted search path vulnerability in the Windows release…6.7
- CVE-2020-19880DBHcms v1.2.0 has a stored xss vulnerability as there is no …6.1
- CVE-2020-19881DBHcms v1.2.0 has a reflected xss vulnerability as there is …4.8
Are you affected by CVE-2020-1987?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST