Palo Alto Networks Security Advisories / CVE-2020-1989

CVE-2020-1989 GlobalProtect Agent: Incorrect privilege assignment allows local privilege escalation

Severity 7 · HIGH
Attack Vector LOCAL
Attack Complexity HIGH
Privileges Required LOW
User Interaction NONE
Confidentiality Impact HIGH
Integrity Impact HIGH
Availability Impact HIGH


An incorrect privilege assignment vulnerability when writing application-specific files in the Palo Alto Networks GlobalProtect Agent for Linux on ARM platform allows a local authenticated user to gain root privileges on the system.

This issue affects Palo Alto Networks GlobalProtect Agent for Linux 5.0 versions before 5.0.8; 5.1 versions before 5.1.1.

Product Status

GlobalProtect Agent 5.1< 5.1.1 on Linux ARM>= 5.1.1 on Linux ARM
GlobalProtect Agent 5.0< 5.0.8 on Linux ARM>= 5.0.8 on Linux ARM

Severity: HIGH

CVSSv3.1 Base Score: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness Type

CWE-266 Incorrect Privilege Assignment


This issue is fixed in GlobalProtect Agent 5.0.8, GlobalProtect Agent 5.1.1 and all later versions.

Workarounds and Mitigations

There are no viable workarounds for this issue.


Initial publication
© 2020 Palo Alto Networks, Inc. All rights reserved.