Palo Alto Networks GlobalProtect App up to 5.1.11/6.0.7/6.1.2/6.2.2 log file

Summaryinfo

A vulnerability classified as problematic has been found in Palo Alto Networks GlobalProtect App up to 5.1.11/6.0.7/6.1.2/6.2.2. This vulnerability affects unknown code. This manipulation causes log file. This vulnerability appears as CVE-2024-5908. The attack requires local access. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Palo Alto Networks GlobalProtect App up to 5.1.11/6.0.7/6.1.2/6.2.2. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a log file vulnerability. The CWE definition for the vulnerability is CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. As an impact it is known to affect confidentiality. The summary by CVE is:

A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.

The weakness was presented by Denis Faiustov and Ruslan Sayfiev. It is possible to read the advisory at security.paloaltonetworks.com. This vulnerability is known as CVE-2024-5908. The exploitation appears to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 5.1.12, 6.0.8, 6.1.3 or 6.2.3 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Palo Alto Networks

Name

• GlobalProtect App

Version

• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5
• 5.1.6
• 5.1.7
• 5.1.8
• 5.1.9
• 5.1.10
• 5.1.11
• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5
• 6.0.6
• 6.0.7
• 6.1.0
• 6.1.1
• 6.1.2
• 6.2.0
• 6.2.1
• 6.2.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion