CVE-2024-2431

Description

An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disable GlobalProtect with a passcode.

Overview

State: PUBLISHED
Assigner (CNA): palo_alto
CVSS severity: MEDIUM
CVSS score: 5.5 / 10
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Effective score: 5.5 / 10 MEDIUM source: CNA overview
CWE(s): CWE-269
Reserved: 2024-03-13
Published: 2024-03-13 18:51 UTC
Last updated: 2024-08-05 15:31 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/2xxx/CVE-2024-2431.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2024-03-13 18:15:08 UTC
NVD last modified: 2026-06-17 07:24:31 UTC
NVD CVSS v3.1: 5.5 / 10 MEDIUM source: psirt@paloaltonetworks.com
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability subscore: 1.8 / 10
Impact subscore: 3.6 / 10
EPSS score: 0.0015 (probability of exploitation in next 30 days)
EPSS percentile: 4.93% vs all CVEs — higher = more likely to be exploited, as of 2026-07-26

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2024-27382
Assigner: palo_alto
Published: Mar 13, 2024, 5:51:17 PM
Updated: Aug 5, 2024, 1:31:26 PM
EUVD base score (CVSS 3.1): 5.5 / 10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EUVD-reported EPSS: 0.0500
Vendors: Palo Alto Networks
Products: GlobalProtect App

GlobalProtect App (6.1 <6.1.1)

GlobalProtect App (5.1 <5.1.12)

GlobalProtect App (5.2 <5.2.13)

GlobalProtect App (6.0 <6.0.4)
Aliases: GHSA-vr6p-mmxj-phm2

ENISA description: An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disable GlobalProtect with a passcode.

EUVD references (1)

https://security.paloaltonetworks.com/CVE-2024-2431

Affected products (1)

Vendor	Product	Versions	Platforms
Palo Alto Networks	GlobalProtect App	`6.0` (affected), `5.1` (affected), `5.2` (affected), `6.1` (affected), `6.2` (unaffected)	—

Affected products — CPE 2.3 (2) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:-:*:*
cpe:2.3:a:paloaltonetworks:globalprotect:6.1.0:*:*:*:*:-:*:*

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://security.paloaltonetworks.com/CVE-2024-2431

MITRE references (1) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://security.paloaltonetworks.com/CVE-2024-2431

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

http://cwe.mitre.org/data/definitions/269.html rapid7:cwe.mitre.org
https://attackerkb.com/topics/CVE-2024-2431 rapid7:attackerkb.com
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-27382 rapid7:euvd.enisa.europa.eu
https://security.paloaltonetworks.com/json/CVE-2024-2431 rapid7:security.paloaltonetworks.com
https://www.cve.org/CVERecord?id=CVE-2024-2431 rapid7:www.cve.org

NVD-tagged references (2)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://security.paloaltonetworks.com/CVE-2024-2431 psirt@paloaltonetworks.com Vendor Advisory
https://security.paloaltonetworks.com/CVE-2024-2431 af854a3a-2127-422b-91ae-364da2661108 Vendor Advisory

Remediations (10)

Patch Management Best Practices for 2025 | RSI Security

web:blog.rsisecurity.com

Reduces financial exposure: Minimizes the risk of costly data breaches, penalties, and remediation expenses. In short, an effective Patch Management policy not only improves security, it drives business continuity and long-term confidence. 2025 Patch Management Best Practices (Based on NIST SP 800-40 Rev. 4)

2026-05-23 06:41 UTC
CISA Warns of Exploited Microsoft Defender 0-Day Flaws

web:cyberpress.org

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026.

2026-05-23 06:41 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-05-23 06:41 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-23 06:41 UTC
Microsoft Patches Two Actively Exploited Defender Zero-Days on Windows

web:windowsreport.com

Microsoft patched two actively exploited Defender zero-days affecting Windows systems and security components.

2026-05-23 06:41 UTC
CISA Adds One Known Exploited Vulnerability to Catalog

web:www.cisa.gov

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and ...

2026-05-23 06:41 UTC
April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

2026-05-23 06:41 UTC
2 New Microsoft Defender Zero-Days Exploited—Patch Now ... - Forbes

web:www.forbes.com

Microsoft has confirmed an emergency security update as CISA warns that two new Defender zero-days are being exploited by attackers.

2026-05-23 06:41 UTC
Software Patching Best Practices: Don't Skip Updates | Infosec

web:www.infosecinstitute.com

You can treat vulnerabilities in three ways: Remediate: Apply the patch or update to the software or system, so it's safe from exploitation. Mitigate: If remediation isn't an option because there is no patch or there are issues in updating the applications, then you move to mitigate.

2026-05-23 06:41 UTC
Security Update Guide FAQs - microsoft.com

web:www.microsoft.com

These Knowledge Base articles accompany all security updates and advisories, and include caveats or known issues with security updates. Additionally, support engineers document common concerns from customers in these KB articles. These Knowledge Base articles are published the Security Update Guide with each release on Patch Tuesday.

2026-05-23 06:41 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2024-2431.json.

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T19:11:53.593Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2024-2431"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:paloaltonetworks:globalprotect:5.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:paloaltonetworks:globalprotect:5.2:*:*:*:*:universal_windows_platform:*:*",
              "cpe:2.3:a:paloaltonetworks:globalprotect:6.0.0:*:*:*:*:universal_windows_platform:*:*",
              "cpe:2.3:a:paloaltonetworks:globalprotect:6.1.0:*:*:*:*:universal_windows_platform:*:*",
              "cpe:2.3:a:paloaltonetworks:globalprotect:6.2.0:*:*:*:*:windows:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "globalprotect",
            "vendor": "paloaltonetworks",
            "versions": [
              {
                "lessThan": "5.1.12",
                "status": "affected",
                "version": "5.1",
                "versionType": "custom"
              },
              {
                "lessThan": "5.2.13",
                "status": "affected",
                "version": "5.2",
                "versionType": "custom"
              },
              {
                "lessThan": "6.0.4",
                "status": "affected",
                "version": "6.0.0",
                "versionType": "custom"
              },
              {
                "lessThan": "6.1.1",
                "status": "affected",
                "version": "6.1.0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "6.2.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-2431",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-15T15:20:30.083812Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-05T13:31:26.517Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GlobalProtect App",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.0.4",
                  "status": "unaffected"
                }
              ],
              "lessThan": "6.0.4",
              "status": "affected",
              "version": "6.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "5.1.12",
                  "status": "unaffected"
                }
              ],
              "lessThan": "5.1.12",
              "status": "affected",
              "version": "5.1",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "5.2.13",
                  "status": "unaffected"
                }
              ],
              "lessThan": "5.2.13",
              "status": "affected",
              "version": "5.2",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "6.1.1",
                  "status": "unaffected"
                }
              ],
              "lessThan": "6.1.1",
              "status": "affected",
              "version": "6.1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "6.2"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This is an issue only if \"Allow User to Disable GlobalProtect App\" is set to \"Allow with Passcode\". You should check this setting in your firewall web interface (Network > GlobalProtect > Portals > (portal-config) > Agent > (agent-config) > App) and take the appropriate actions as needed."
            }
          ],
          "value": "This is an issue only if \"Allow User to Disable GlobalProtect App\" is set to \"Allow with Passcode\". You should check this setting in your firewall web interface (Network > GlobalProtect > Portals > (portal-config) > Agent > (agent-config) > App) and take the appropriate actions as needed."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Palo Alto Networks thanks AIG Red Team and Stephen Collyer for discovering and reporting this issue."
        }
      ],
      "datePublic": "2024-03-13T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disable GlobalProtect with a passcode."
            }
          ],
          "value": "An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disable GlobalProtect with a passcode."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.<br>"
            }
          ],
          "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-13T17:51:17.735Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "url": "https://security.paloaltonetworks.com/CVE-2024-2431"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This issue is fixed in GlobalProtect app 5.1.12, GlobalProtect app 5.2.13, GlobalProtect app 6.0.4, GlobalProtect app 6.1.1, and all later GlobalProtect app versions.<br>"
            }
          ],
          "value": "This issue is fixed in GlobalProtect app 5.1.12, GlobalProtect app 5.2.13, GlobalProtect app 6.0.4, GlobalProtect app 6.1.1, and all later GlobalProtect app versions.\n"
        }
      ],
      "source": {
        "defect": [
          "GPC-15349"
        ],
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-03-13T16:00:00.000Z",
          "value": "Initial publication"
        }
      ],
      "title": "GlobalProtect App: Local User Can Disable GlobalProtect",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "You can mitigate this issue by setting \"Allow User to Disable GlobalProtect App\" to \"Disallow\" or \"Allow with Ticket.\"<br>"
            }
          ],
          "value": "You can mitigate this issue by setting \"Allow User to Disable GlobalProtect App\" to \"Disallow\" or \"Allow with Ticket.\"\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2024-2431",
    "datePublished": "2024-03-13T17:51:17.735Z",
    "dateReserved": "2024-03-13T16:19:25.624Z",
    "dateUpdated": "2024-08-05T13:31:26.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}