CVE-2024-5916 — Cleartext Storage in a File or on Disk in Palo Alto Networks Pan-os

CWE-313 — Cleartext Storage in a File or on DiskCWE-312 — Cleartext Storage of Sensitive Info5 documents5 sources
Severity
6.0MEDIUMNVD
EPSS
0.1%
top 75.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Palo Alto Networks Pan-osPaloaltonetworks Pan-osPalo Alto Networks Cloud Ngfw+3 more
Timeline
PublishedAug 14
Latest updateApr 11

Description

An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords, and tokens of external systems. A read-only administrator who has access to the config log, can read secrets, passwords, and tokens to external systems.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N

Affected Packages6 packages

▶NVDpaloaltonetworks/pan-os10.2.0 — 10.2.8+1
▶CVEListV5palo_alto_networks/pan-os10.2 — 10.2.8+1
▶CVEListV5palo_alto_networks/cloud_ngfwBefore 8/15, Before 8/23+1
▶Palo Altopaloalto/pan-os

🔴Vulnerability Details

2
GHSA
GHSA-cvjp-23hx-635r: An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets,↗2024-08-14
▶
CVEList
PAN-OS: Cleartext Exposure of External System Secrets↗2024-08-14
▶

💥Exploits & PoCs

1
Exploit-DB
ABB Cylon Aspect 3.08.02 - PHP Session Fixation↗2025-04-11
▶

📋Vendor Advisories

1
Palo Alto
PAN-OS: Cleartext Exposure of External System Secrets↗2024-08-14
▶
CVE-2024-5916 — Cleartext Storage in a File or on Disk | cvebase