Skip to content

CVE-2021-45809 GlobalProtect-openconnect versions prior to 1.4.3 are affected by incorrect access control in GPService through DBUS, GUI Application. The way GlobalProtect-Openconnect is set up enables arbitrary use...

CriticalCVSS 9.8 EPSS 1.6%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

GlobalProtect-openconnect versions prior to 1.4.3 are affected by incorrect access control in GPService through DBUS, GUI Application. The way GlobalProtect-Openconnect is set up enables arbitrary users to execute commands as root by submitting the --script=<script> parameter.

Affected products

ProductAffected versionsFixed in
globalprotect-openconnect project globalprotect-openconnect < 1.4.3 1.4.3

References

  • github.com exploit issue-tracking mitigation third-party-advisory