[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPLtbatAOeUM-XMf3PswdDXdUAliXtW7ClYjMXplhjo4":3,"g5a-risk:CVE-2020-2033":119},{"success":4,"data":5,"meta":117},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":42,"epssPercentile":26,"epssTimeSeries":43,"severity":44,"affectedProducts":45,"affectedProductsCount":51,"references":52,"referencesCount":51,"weaknesses":58,"weaknessesCount":73,"isActivelyExploited":74,"cisaInfo":26,"otxData":26,"relatedBlogPosts":75,"seoMetadata":76,"configurations":101,"relatedVendorCves":115,"notableEvents":116},"CVE-2020-2033","What is CVE-2020-2033?","When the pre-logon feature is enabled, a missing certification validation in Palo Alto Networks GlobalProtect app can disclose the pre-logon authentication cookie to a man-in-the-middle attacker on the same local area network segment with the ability to manipulate ARP or to conduct ARP spoofing attacks. This allows the attacker to access the GlobalProtect Server as allowed by configured Security rules for the 'pre-login' user. This access may be limited compared to the network access of regular users. This issue affects: GlobalProtect app 5.0 versions earlier than GlobalProtect app 5.0.10 when the prelogon feature is enabled; GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.4 when the prelogon feature is enabled.","When the pre-logon feature is enabled, a missing certification validation in Palo Alto Networks GlobalProtect app can disclose the pre-logon authentication c...","2020-06-10T18:15:11.86","2020-06-16T16:01:48.51",5.3,"CVSS:3.1\u002FAV:A\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":26,"CVSSMetricV2":33,"CVSSMetricV40":26},[16,29],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":22,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":23,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","ADJACENT_NETWORK","HIGH","NONE","UNCHANGED","MEDIUM",null,1.6,3.6,{"Source":30,"Type":31,"CVSSData":32,"ExploitabilityScore":27,"ImpactScore":28},"psirt@paloaltonetworks.com","Secondary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":22,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":23,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},[34],{"Source":17,"Type":18,"CVSSData":35,"BaseSeverity":40,"ExploitabilityScore":41,"ImpactScore":39,"ACInsufInfo":26,"ObtainAllPrivilege":26,"ObtainUserPrivilege":26,"ObtainOtherPrivilege":26,"UserInteractionRequired":26},{"Version":36,"VectorString":37,"AccessVector":21,"AccessComplexity":25,"Authentication":23,"ConfidentialityImpact":38,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":39,"BaseSeverity":26,"Exploitability":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"CollateralDamagePotential":26,"TargetDistribution":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"EnvironmentalScore":26},"2.0","AV:A\u002FAC:M\u002FAu:N\u002FC:P\u002FI:N\u002FA:N","PARTIAL",2.9,"LOW",5.5,0.00871,[42,42,42,42,42,42,42],"Medium",[46],{"vendor":47,"product":48,"version":49,"criteria":50,"vulnerable":4},"paloaltonetworks","globalprotect","*","cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:*",1,[53],{"url":54,"source":55,"tags":56},"https:\u002F\u002Fsecurity.paloaltonetworks.com\u002FCVE-2020-2033","Paloaltonetworks",[57],"Vendor Advisory",[59,67],{"id":60,"name":61,"description":62,"extendedDescription":63,"status":64,"abstraction":65,"structure":66},"CWE-290","Authentication Bypass by Spoofing","This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.","","Incomplete","Base","Simple",{"id":68,"name":69,"description":70,"extendedDescription":71,"status":72,"abstraction":65,"structure":66},"CWE-295","Improper Certificate Validation","The product does not validate, or incorrectly validates, a certificate.","When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.","Draft",2,false,[],{"title":77,"metaDescription":78,"keywords":79,"canonicalUrl":80,"structuredData":81},"What is CVE-2020-2033? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2020-2033, a medium severity cyber security vulnerability from 2020. When the pre-logon feature is enabled, a missing certifica...","CVE-2020-2033, CVE-2020-2033 vulnerability, CVE-2020-2033 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2020, CVSS score, exploit, patch, remediation, paloaltonetworks security, globalprotect vulnerability","\u002Fwhat-is\u002Fcve-2020-2033",{"@context":82,"@type":83,"headline":77,"description":78,"datePublished":10,"dateModified":11,"author":84,"publisher":88,"about":92,"mainEntityOfPage":96,"articleSection":99,"keywords":100},"https:\u002F\u002Fschema.org","TechArticle",{"@type":85,"name":86,"url":87},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":85,"name":86,"url":87,"logo":89},{"@type":90,"url":91},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":93,"name":6,"description":94,"additionalType":95},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":97,"@id":98},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2020-2033","Cybersecurity","CVE-2020-2033, CVE-2020-2033 vulnerability, CVE-2020-2033 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[102],{"Operator":26,"Negate":26,"Nodes":103},[104],{"Operator":105,"Negate":26,"CPEMatch":106},"OR",[107,111],{"Vulnerable":4,"Criteria":50,"MatchCriteriaID":108,"VersionStartExcluding":26,"VersionStartIncluding":109,"VersionEndExcluding":110,"VersionEndIncluding":26},"2D325D3A-D857-4528-A6CC-0E8142A38C58","5.0.0","5.0.10",{"Vulnerable":4,"Criteria":50,"MatchCriteriaID":112,"VersionStartExcluding":26,"VersionStartIncluding":113,"VersionEndExcluding":114,"VersionEndIncluding":26},"5BF3D585-3F87-492B-8CE9-54122A2D228A","5.1.0","5.1.4",[],[],{"lastModified":11,"cacheTime":118,"version":36},1792237733821,{"score":120,"band":121,"action":122,"scoredAt":123},16,"Info","Track","2026-10-16T06:48:48.148103+00:00"]