CVE-2020-2033 GlobalProtect App: Missing certificate validation vulnerability can disclose pre-logon authentication cookie
A missing certificate validation in the GlobalProtect app allows attackers to steal pre-logon cookies via ARP spoofing, bypassing authentication controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-2033?
CVE-2020-2033 is a medium-severity vulnerability in Palo Alto Networks GlobalProtect App, published on 10 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
When the pre-logon feature is enabled, a missing certification validation in Palo Alto Networks GlobalProtect app can disclose the pre-logon authentication cookie to a man-in-the-middle attacker on the same local area network segment with the ability to manipulate ARP or to conduct ARP spoofing attacks. This allows the attacker to access the GlobalProtect Server as allowed by configured Security rules for the 'pre-login' user. This access may be limited compared to the network access of regular users. This issue affects: GlobalProtect app 5.0 versions earlier than GlobalProtect app 5.0.10 when the prelogon feature is enabled; GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.4 when the prelogon feature is enabled.
Which versions are affected by CVE-2020-2033?
It affects 1 product.
Products include Paloaltonetworks Globalprotect.
How do I fix CVE-2020-2033?
No fix has been published for CVE-2020-2033 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-2033 being exploited?
There is no known exploitation of CVE-2020-2033 in the wild and no public exploit code.
Other vulnerabilities in Palo Alto Networks GlobalProtect App
- CVE-2025-4232 GlobalProtect: Authenticated Code Injection Through Wildcard on macOS
- CVE-2021-3057 GlobalProtect App: Buffer Overflow Vulnerability When Connecting to Portal or Gateway
- CVE-2023-0009 GlobalProtect App: Local Privilege Escalation (PE) Vulnerability
- CVE-2022-0016 GlobalProtect App: Privilege Escalation Vulnerability When Using Connect Before Logon
- CVE-2025-0120 GlobalProtect App: Local Privilege Escalation (PE) Vulnerability
Sources
Also known as GHSA-8p7q-qxxf-h3cm.