CVE-2024-5916
published 2024-08-14CVE-2024-5916: An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets…
PriorityP418medium4.4CVSS 3.1
AVLACLPRHUINSUCHINAN
EPSS
0.25%
16.0th percentile
An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords, and tokens of external systems. A read-only administrator who has access to the config log, can read secrets, passwords, and tokens to external systems.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| palo_alto_networks | cloud_ngfw | — | — |
| palo_alto_networks | cloud_ngfw | — | — |
| palo_alto_networks | pan-os | >= 10.2 < 10.2.8 | 10.2.8 |
| palo_alto_networks | pan-os | >= 11.0 < 11.0.4 | 11.0.4 |
| paloalto | cloud_ngfw | — | — |
| paloalto | pan-os | — | — |
| paloalto | prisma_access | — | — |
| paloaltonetworks | pan-os | >= 10.2.0 < 10.2.8 | 10.2.8 |
| paloaltonetworks | pan-os | >= 11.0.0 < 11.0.4 | 11.0.4 |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv4.06.0MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Amber
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-OS: Cleartext Exposure of External System Secrets
vendor_paloalto·2024-08-14·CVSS 6.0
CVE-2024-5916 [MEDIUM] CWE-313 PAN-OS: Cleartext Exposure of External System Secrets
PAN-OS: Cleartext Exposure of External System Secrets
An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords, and tokens of external systems. A read-only administrator who has access to the config log, can read secrets, passwords, and tokens to external systems.
Affected products: Cloud NGFW, PAN-OS, Prisma Access
Solution: This issue is fixed in PAN-OS 10.2.8, PAN-OS 11.0.4, and all later PAN-OS versions. This issue is fixed in Cloud NGFW on or after 8/15 on Azure, Cloud NGFW on or after 8/23 on AWS, and all later Cloud NGFW versions.
You should also revoke the secrets, passwords, and tokens that are configured in all server profiles of affected PAN-OS firewalls (Device > Server Pr
GHSA
GHSA-cvjp-23hx-635r: An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets,
ghsa_unreviewed·2024-08-14
CVE-2024-5916 [MEDIUM] CWE-312 GHSA-cvjp-23hx-635r: An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets,
An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords, and tokens of external systems. A read-only administrator who has access to the config log, can read secrets, passwords, and tokens to external systems.
No detection rules found.
No writeups or analysis indexed.
2024-08-14
Published