CVE-2024-5908
published 2024-06-12CVE-2024-5908: A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in…
PriorityP337high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.37%
28.6th percentile
A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| palo_alto_networks | globalprotect_app | >= 5.1.0 < 5.1.12 | 5.1.12 |
| palo_alto_networks | globalprotect_app | >= 6.0.0 < 6.0.8 | 6.0.8 |
| palo_alto_networks | globalprotect_app | >= 6.1.0 < 6.1.3 | 6.1.3 |
| palo_alto_networks | globalprotect_app | >= 6.2.0 < 6.2.3 | 6.2.3 |
| paloalto | globalprotect_app | — | — |
| paloaltonetworks | globalprotect | >= 5.1 < 5.1.12 | 5.1.12 |
| paloaltonetworks | globalprotect | >= 6.0 < 6.0.8 | 6.0.8 |
| paloaltonetworks | globalprotect | >= 6.1 < 6.1.3 | 6.1.3 |
| paloaltonetworks | globalprotect | >= 6.2 < 6.2.3 | 6.2.3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
GlobalProtect App: Encrypted Credential Exposure via Log Files
vendor_paloalto·2024-06-12·CVSS 5.5
CVE-2024-5908 [MEDIUM] CWE-532 GlobalProtect App: Encrypted Credential Exposure via Log Files
GlobalProtect App: Encrypted Credential Exposure via Log Files
A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.
Affected products: GlobalProtect App
Solution: This issue is fixed in GlobalProtect app 5.1.12, GlobalProtect app 6.0.8, GlobalProtect app 6.1.3, GlobalProtect app 6.2.3, and all later GlobalProtect app versions.
Customers looking to protect against the impact of this encrypted password disclosure should first delete PanGPA.log files
GHSA
GHSA-6q37-cp6x-mhfw: A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in
ghsa_unreviewed·2024-06-12
CVE-2024-5908 [MEDIUM] CWE-532 GHSA-6q37-cp6x-mhfw: A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in
A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-06-12
Published