CVE-2022-0021CWE-532

GlobalProtect App: Information Exposure Vulnerability When Using Connect Before Logon

Low · published February 10, 2022

CVSS v3.1
3.3
EPSS
0%
Percentile
12.3
In the wild
Unconfirmed
What it is

An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the connecting GlobalProtect user when authenticating using Connect Before Logon feature. This issue impacts GlobalProtect App 5.2 versions earlier than 5.2.9 on Windows. This issue does not affect the GlobalProtect app on other platforms.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00224 · 12.3th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2022-02-10T18:10Z
EPSS history
Timeline
  • 10 FEB 18:10Z
    GlobalProtect App: Information Exposure Vulnerability When Using Connect Before Logon
    cvelistv5