CVE-2024-5908CWE-532

GlobalProtect App: Encrypted Credential Exposure via Log Files

Medium · published June 12, 2024

CVSS v4.0
5.5
EPSS
0%
Percentile
29.3
In the wild
Unconfirmed
What it is

A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.

The record
Technical detail
CVSS v4.0
5.5 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/AU:N/R:U/V:D/RE:M/U:Amber
EPSS
0.00366 · 29.3th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2024-06-12T16:28Z
EPSS history
Timeline
  • 12 JUN 16:28Z
    GlobalProtect App: Encrypted Credential Exposure via Log Files
    cvelistv5