CVE-2020-1997: 
PAN-OS vulnerability analysis and mitigation

An open redirection vulnerability (CVE-2020-1997) was discovered in the GlobalProtect component of Palo Alto Networks PAN-OS. The vulnerability was disclosed on May 13, 2020, affecting PAN-OS versions 7.1 (earlier than 7.1.26) and 8.0 (earlier than 8.0.14). This security flaw allows attackers to specify an arbitrary redirection target away from the trusted GlobalProtect gateway (Palo Advisory).

The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site) with a CVSS v3.1 Base Score of 5.3 (MEDIUM) according to Palo Alto Networks, and 6.1 (MEDIUM) according to NVD. The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N). The scope is unchanged (S:U) with low confidentiality impact (C:L) and no integrity (I:N) or availability (A:N) impacts (NVD, Palo Advisory).

If successfully exploited, the vulnerability allows an attacker to redirect users who successfully authenticate to unexpected and potentially malicious websites, bypassing the trusted GlobalProtect gateway. This poses a significant risk as users may unknowingly access malicious content while believing they are connected to legitimate resources (Palo Advisory).

The vulnerability has been fixed in PAN-OS versions 7.1.26, 8.0.14, and all later PAN-OS versions. Organizations running affected versions should upgrade to the patched versions to mitigate this security risk. All PAN-OS versions 9.0 and later are unaffected by this vulnerability (Palo Advisory).