CVE-2024-8687CWE-497

PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes

Medium · published September 11, 2024

CVSS v4.0
6.9
EPSS
0%
Percentile
34.0
In the wild
Unconfirmed
What it is

An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the GlobalProtect app configuration would not normally permit them to do so.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:M/U:Amber
EPSS
0.00409 · 34.0th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2024-09-11T16:40Z
EPSS history
Timeline
  • 11 SEP 16:40Z
    PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes
    cvelistv5