CVE-2024-5908

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-5908", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "state": "PUBLISHED", "assignerShortName": "palo_alto", "dateReserved": "2024-06-12T15:27:55.490Z", "datePublished": "2024-06-12T16:28:08.131Z", "dateUpdated": "2024-08-09T19:08:25.260Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "GlobalProtect App", "vendor": "Palo Alto Networks", "versions": [{"changes": [{"at": "5.1.12", "status": "unaffected"}], "lessThan": "5.1.12", "status": "affected", "version": "5.1.0", "versionType": "custom"}, {"changes": [{"at": "6.0.8", "status": "unaffected"}], "lessThan": "6.0.8", "status": "affected", "version": "6.0.0", "versionType": "custom"}, {"changes": [{"at": "6.1.3", "status": "unaffected"}], "lessThan": "6.1.3", "status": "affected", "version": "6.1.0", "versionType": "custom"}, {"changes": [{"at": "6.2.3", "status": "unaffected"}], "lessThan": "6.2.3", "status": "affected", "version": "6.2.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Palo Alto Networks thanks Denis Faiustov and Ruslan Sayfiev of GMO Cybersecurity by IERAE for discovering and reporting this issue."}], "datePublic": "2024-06-12T07:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.</p>"}], "value": "A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs."}], "exploits": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Palo Alto Networks is not aware of any malicious exploitation of this issue.</p>"}], "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."}], "impacts": [{"capecId": "CAPEC-150", "descriptions": [{"lang": "en", "value": "CAPEC-150 Collect Data from Common Resource Locations"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NO", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 5.5, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/AU:N/R:U/V:D/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "description": "CWE-532: Insertion of Sensitive Information into Log File", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2024-06-12T16:28:08.131Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://security.paloaltonetworks.com/CVE-2024-5908"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>This issue is fixed in GlobalProtect app 5.1.12, GlobalProtect app 6.0.8, GlobalProtect app 6.1.3, GlobalProtect app 6.2.3, and all later GlobalProtect app versions.</p><p>Customers looking to protect against the impact of this encrypted password disclosure should first delete PanGPS.log files from the GlobalProtect installation directory on all endpoints and then force a rotation of user passwords that are used to connect to GlobalProtect.</p>"}], "value": "This issue is fixed in GlobalProtect app 5.1.12, GlobalProtect app 6.0.8, GlobalProtect app 6.1.3, GlobalProtect app 6.2.3, and all later GlobalProtect app versions.\n\nCustomers looking to protect against the impact of this encrypted password disclosure should first delete PanGPS.log files from the GlobalProtect installation directory on all endpoints and then force a rotation of user passwords that are used to connect to GlobalProtect."}], "source": {"defect": ["GPC-18597"], "discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2024-06-12T16:00:00.000Z", "value": "Initial publication"}], "title": "GlobalProtect App: Encrypted Credential Exposure via Log Files", "x_generator": {"engine": "vulnogram 0.1.0-rc1"}, "x_legacyV4Record": {"CNA_private": {"Priority": "normal", "STATE": "review", "TYPE": "advisory", "affectsSummary": {"affected": ["< 6.2.3", "< 6.1.3", "< 6.0.8", "< 5.1.12"], "appliesTo": ["GlobalProtect App 6.2", "GlobalProtect App 6.1", "GlobalProtect App 6.0", "GlobalProtect App 5.1"], "product_versions": ["GlobalProtect App 6.2", "GlobalProtect App 6.1", "GlobalProtect App 6.0", "GlobalProtect App 5.1"], "unaffected": [">= 6.2.3", ">= 6.1.3", ">= 6.0.8", ">= 5.1.12"], "unknown": ["", "", "", ""]}, "owner": "carjones", "publish": {"month": "06", "year": "2024", "ym": "2024-06"}, "share_with_CVE": true, "show_cvss": true}, "CVE_data_meta": {"ASSIGNER": "psirt@paloaltonetworks.com", "DATE_PUBLIC": "2024-06-12T16:00:00.000Z", "ID": "CVE-2023-case-GPC-18597", "STATE": "PUBLIC", "TITLE": "GlobalProtect App: Encrypted Credential Exposure via Log Files"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "GlobalProtect App", "version": {"version_data": [{"version_affected": "<", "version_name": "5.1", "version_value": "5.1.12"}, {"version_affected": "<", "version_name": "6.0", "version_value": "6.0.8"}, {"version_affected": "<", "version_name": "6.1", "version_value": "6.1.3"}, {"version_affected": "<", "version_name": "6.2", "version_value": "6.2.3"}, {"version_affected": "!>=", "version_name": "5.1", "version_value": "5.1.12"}, {"version_affected": "!>=", "version_name": "6.0", "version_value": "6.0.8"}, {"version_affected": "!>=", "version_name": "6.1", "version_value": "6.1.3"}, {"version_affected": "!>=", "version_name": "6.2", "version_value": "6.2.3"}]}}]}, "vendor_name": "Palo Alto Networks"}]}}, "credit": [{"lang": "eng", "value": "Palo Alto Networks thanks Denis Faiustov and Ruslan Sayfiev of GMO Cybersecurity by IERAE for discovering and reporting this issue."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs."}]}, "exploit": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."}], "generator": {"engine": "vulnogram 0.1.0-rc1"}, "impact": {"cvss": {"Automatable": "NO", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 5.5, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/AU:N/R:U/V:D/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-532: Insertion of Sensitive Information into Log File"}]}]}, "references": {"reference_data": [{"refsource": "CONFIRM", "url": "https://security.paloaltonetworks.com/CVE-2023-case-GPC-18597"}]}, "solution": [{"lang": "en", "value": "This issue is fixed in GlobalProtect app 5.1.12, GlobalProtect app 6.0.8, GlobalProtect app 6.1.3, GlobalProtect app 6.2.3, and all later GlobalProtect app versions.Customers looking to protect against the impact of this encrypted password disclosure should first delete PanGPS.log files from the GlobalProtect installation directory on all endpoints and then force a rotation of user passwords that are used to connect to GlobalProtect."}], "source": {"defect": ["GPC-18597"], "discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2024-06-12T00:00:00.000Z", "value": "Initial publication"}], "x_advisoryEoL": false}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:25:03.175Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://security.paloaltonetworks.com/CVE-2024-5908"}]}, {"affected": [{"vendor": "paloaltonetworks", "product": "globalprotect", "cpes": ["cpe:2.3:a:paloaltonetworks:globalprotect:5.1:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "5.1", "status": "affected", "lessThan": "5.1.12", "versionType": "custom"}]}, {"vendor": "paloaltonetworks", "product": "globalprotect", "cpes": ["cpe:2.3:a:paloaltonetworks:globalprotect:6.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "6.0.0", "status": "affected", "lessThan": "6.0.8", "versionType": "custom"}]}, {"vendor": "paloaltonetworks", "product": "globalprotect", "cpes": ["cpe:2.3:a:paloaltonetworks:globalprotect:6.1.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "6.1.0", "status": "affected", "lessThan": "6.1.3", "versionType": "custom"}]}, {"vendor": "paloaltonetworks", "product": "globalprotect", "cpes": ["cpe:2.3:a:paloaltonetworks:globalprotect:6.2.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "6.2.0", "status": "affected", "lessThan": "6.2.3", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-09T18:53:54.949374Z", "id": "CVE-2024-5908", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-09T19:08:25.260Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.paloaltonetworks.com/CVE-2024-5908", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:25:03.175Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-5908", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-09T18:53:54.949374Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:paloaltonetworks:globalprotect:5.1:*:*:*:*:*:*:*"], "vendor": "paloaltonetworks", "product": "globalprotect", "versions": [{"status": "affected", "version": "5.1", "lessThan": "5.1.12", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:paloaltonetworks:globalprotect:6.0.0:*:*:*:*:*:*:*"], "vendor": "paloaltonetworks", "product": "globalprotect", "versions": [{"status": "affected", "version": "6.0.0", "lessThan": "6.0.8", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:paloaltonetworks:globalprotect:6.1.0:*:*:*:*:*:*:*"], "vendor": "paloaltonetworks", "product": "globalprotect", "versions": [{"status": "affected", "version": "6.1.0", "lessThan": "6.1.3", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:paloaltonetworks:globalprotect:6.2.0:*:*:*:*:*:*:*"], "vendor": "paloaltonetworks", "product": "globalprotect", "versions": [{"status": "affected", "version": "6.2.0", "lessThan": "6.2.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-09T19:08:01.493Z"}}], "cna": {"title": "GlobalProtect App: Encrypted Credential Exposure via Log Files", "source": {"defect": ["GPC-18597"], "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Palo Alto Networks thanks Denis Faiustov and Ruslan Sayfiev of GMO Cybersecurity by IERAE for discovering and reporting this issue."}], "impacts": [{"capecId": "CAPEC-150", "descriptions": [{"lang": "en", "value": "CAPEC-150 Collect Data from Common Resource Locations"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 5.5, "Automatable": "NO", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/AU:N/R:U/V:D/RE:M/U:Amber", "providerUrgency": "AMBER", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Palo Alto Networks", "product": "GlobalProtect App", "versions": [{"status": "affected", "changes": [{"at": "5.1.12", "status": "unaffected"}], "version": "5.1.0", "lessThan": "5.1.12", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "6.0.8", "status": "unaffected"}], "version": "6.0.0", "lessThan": "6.0.8", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "6.1.3", "status": "unaffected"}], "version": "6.1.0", "lessThan": "6.1.3", "versionType": "custom"}, {"status": "affected", "changes": [{"at": "6.2.3", "status": "unaffected"}], "version": "6.2.0", "lessThan": "6.2.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Palo Alto Networks is not aware of any malicious exploitation of this issue.</p>", "base64": false}]}], "timeline": [{"lang": "en", "time": "2024-06-12T16:00:00.000Z", "value": "Initial publication"}], "solutions": [{"lang": "en", "value": "This issue is fixed in GlobalProtect app 5.1.12, GlobalProtect app 6.0.8, GlobalProtect app 6.1.3, GlobalProtect app 6.2.3, and all later GlobalProtect app versions.\n\nCustomers looking to protect against the impact of this encrypted password disclosure should first delete PanGPS.log files from the GlobalProtect installation directory on all endpoints and then force a rotation of user passwords that are used to connect to GlobalProtect.", "supportingMedia": [{"type": "text/html", "value": "<p>This issue is fixed in GlobalProtect app 5.1.12, GlobalProtect app 6.0.8, GlobalProtect app 6.1.3, GlobalProtect app 6.2.3, and all later GlobalProtect app versions.</p><p>Customers looking to protect against the impact of this encrypted password disclosure should first delete PanGPS.log files from the GlobalProtect installation directory on all endpoints and then force a rotation of user passwords that are used to connect to GlobalProtect.</p>", "base64": false}]}], "datePublic": "2024-06-12T07:00:00.000Z", "references": [{"url": "https://security.paloaltonetworks.com/CVE-2024-5908", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "vulnogram 0.1.0-rc1"}, "descriptions": [{"lang": "en", "value": "A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.", "supportingMedia": [{"type": "text/html", "value": "<p>A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532: Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2024-06-12T16:28:08.131Z"}, "x_legacyV4Record": {"credit": [{"lang": "eng", "value": "Palo Alto Networks thanks Denis Faiustov and Ruslan Sayfiev of GMO Cybersecurity by IERAE for discovering and reporting this issue."}], "impact": {"cvss": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 5.5, "Automatable": "NO", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/AU:N/R:U/V:D/RE:M/U:Amber", "providerUrgency": "AMBER", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "MODERATE"}}, "source": {"defect": ["GPC-18597"], "discovery": "EXTERNAL"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_name": "5.1", "version_value": "5.1.12", "version_affected": "<"}, {"version_name": "6.0", "version_value": "6.0.8", "version_affected": "<"}, {"version_name": "6.1", "version_value": "6.1.3", "version_affected": "<"}, {"version_name": "6.2", "version_value": "6.2.3", "version_affected": "<"}, {"version_name": "5.1", "version_value": "5.1.12", "version_affected": "!>="}, {"version_name": "6.0", "version_value": "6.0.8", "version_affected": "!>="}, {"version_name": "6.1", "version_value": "6.1.3", "version_affected": "!>="}, {"version_name": "6.2", "version_value": "6.2.3", "version_affected": "!>="}]}, "product_name": "GlobalProtect App"}]}, "vendor_name": "Palo Alto Networks"}]}}, "exploit": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."}], "solution": [{"lang": "en", "value": "This issue is fixed in GlobalProtect app 5.1.12, GlobalProtect app 6.0.8, GlobalProtect app 6.1.3, GlobalProtect app 6.2.3, and all later GlobalProtect app versions.Customers looking to protect against the impact of this encrypted password disclosure should first delete PanGPS.log files from the GlobalProtect installation directory on all endpoints and then force a rotation of user passwords that are used to connect to GlobalProtect."}], "timeline": [{"lang": "en", "time": "2024-06-12T00:00:00.000Z", "value": "Initial publication"}], "data_type": "CVE", "generator": {"engine": "vulnogram 0.1.0-rc1"}, "references": {"reference_data": [{"url": "https://security.paloaltonetworks.com/CVE-2023-case-GPC-18597", "refsource": "CONFIRM"}]}, "CNA_private": {"TYPE": "advisory", "STATE": "review", "owner": "carjones", "publish": {"ym": "2024-06", "year": "2024", "month": "06"}, "Priority": "normal", "show_cvss": true, "affectsSummary": {"unknown": ["", "", "", ""], "affected": ["< 6.2.3", "< 6.1.3", "< 6.0.8", "< 5.1.12"], "appliesTo": ["GlobalProtect App 6.2", "GlobalProtect App 6.1", "GlobalProtect App 6.0", "GlobalProtect App 5.1"], "unaffected": [">= 6.2.3", ">= 6.1.3", ">= 6.0.8", ">= 5.1.12"], "product_versions": ["GlobalProtect App 6.2", "GlobalProtect App 6.1", "GlobalProtect App 6.0", "GlobalProtect App 5.1"]}, "share_with_CVE": true}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-532: Insertion of Sensitive Information into Log File"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2023-case-GPC-18597", "STATE": "PUBLIC", "TITLE": "GlobalProtect App: Encrypted Credential Exposure via Log Files", "ASSIGNER": "psirt@paloaltonetworks.com", "DATE_PUBLIC": "2024-06-12T16:00:00.000Z"}, "x_advisoryEoL": false}}}, "cveMetadata": {"cveId": "CVE-2024-5908", "state": "PUBLISHED", "dateUpdated": "2024-08-09T19:08:25.260Z", "dateReserved": "2024-06-12T15:27:55.490Z", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "datePublished": "2024-06-12T16:28:08.131Z", "assignerShortName": "palo_alto"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "GlobalProtect App", "vendor": "Palo Alto Networks", "versions": [{"changes": [{"at": "5.1.12", "status": "unaffected"}], "lessThan": "5.1.12", "status": "affected", "version": "5.1.0", "versionType": "custom"}, {"changes": [{"at": "6.0.8", "status": "unaffected"}], "lessThan": "6.0.8", "status": "affected", "version": "6.0.0", "versionType": "custom"}, {"changes": [{"at": "6.1.3", "status": "unaffected"}], "lessThan": "6.1.3", "status": "affected", "version": "6.1.0", "versionType": "custom"}, {"changes": [{"at": "6.2.3", "status": "unaffected"}], "lessThan": "6.2.3", "status": "affected", "version": "6.2.0", "versionType": "custom"}]}], "source": "psirt@paloaltonetworks.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:paloaltonetworks:globalprotect:5.1:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "globalprotect", "vendor": "paloaltonetworks", "versions": [{"lessThan": "5.1.12", "status": "affected", "version": "5.1", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:paloaltonetworks:globalprotect:6.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "globalprotect", "vendor": "paloaltonetworks", "versions": [{"lessThan": "6.0.8", "status": "affected", "version": "6.0.0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:paloaltonetworks:globalprotect:6.1.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "globalprotect", "vendor": "paloaltonetworks", "versions": [{"lessThan": "6.1.3", "status": "affected", "version": "6.1.0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:paloaltonetworks:globalprotect:6.2.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "globalprotect", "vendor": "paloaltonetworks", "versions": [{"lessThan": "6.2.3", "status": "affected", "version": "6.2.0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E575C68-D93F-4C48-9F6F-2448581BEF43", "versionEndExcluding": "5.1.12", "versionStartIncluding": "5.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:*", "matchCriteriaId": "5557AF19-F260-4764-9263-CD2EEC5EB659", "versionEndExcluding": "6.0.8", "versionStartIncluding": "6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:*", "matchCriteriaId": "2839949C-D855-48F5-8B46-CCA9DFECE25D", "versionEndExcluding": "6.1.3", "versionStartIncluding": "6.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:*", "matchCriteriaId": "D3F3AC34-AB9B-485D-B0F8-67F673D1D4CC", "versionEndExcluding": "6.2.3", "versionStartIncluding": "6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs."}, {"lang": "es", "value": "Un problema con la aplicaci\u00f3n Palo Alto Networks GlobalProtect puede provocar la exposici\u00f3n de las credenciales de usuario cifradas, utilizadas para conectarse a GlobalProtect, en los registros de la aplicaci\u00f3n. Normalmente, estos registros de aplicaciones solo son visibles para usuarios locales y se incluyen al generar registros para solucionar problemas. Esto significa que estas credenciales cifradas est\u00e1n expuestas a los destinatarios de los registros de la aplicaci\u00f3n."}], "id": "CVE-2024-5908", "lastModified": "2026-06-17T08:16:53.300", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE"}, "source": "psirt@paloaltonetworks.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-5908", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-08-09T18:53:54.949374Z", "version": "2.0.3"}}]}, "published": "2024-06-12T17:15:53.253", "references": [{"source": "psirt@paloaltonetworks.com", "tags": ["Vendor Advisory"], "url": "https://security.paloaltonetworks.com/CVE-2024-5908"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://security.paloaltonetworks.com/CVE-2024-5908"}], "sourceIdentifier": "psirt@paloaltonetworks.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "psirt@paloaltonetworks.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-532"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}