CVE-2022-0017: palo alto networks globalprotect app Link Following

Vulnerability summary

CVE-2022-0017 is a high (CVSS 7.8) Link Following vulnerability in palo alto networks globalprotect app. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 18.9% of scored vulnerabilities.

Timeline

1. 10-02-2022
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

An improper link resolution before file access ('link following') vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a local attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges under certain circumstances. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.10 on Windows. GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.5 on Windows. This issue does not affect GlobalProtect app on other platforms.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.