PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes (Palo Alto Networks PAN-OS)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.41 % · percentile 35 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- palo_alto
- NVD status
- Analyzed
Description
An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the GlobalProtect app configuration would not normally permit them to do so.
Weaknesses (CWE)
- CWE-497 — Exposure of Sensitive System Information to an Unauthorized Control Sphere
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 6.9 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:M/U:Amber | palo_alto |
| CVSS 4.0 | MEDIUM 6.9 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber | NVD · psirt@paloaltonetworks.com (Secondary) |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-49346
- GCVE · GCVE-0-2024-8687
CERT-FR advisories
- CERTFR-2024-AVI-0770 — Multiples vulnérabilités dans les produits Palo Alto Networks · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 8.1.0 < 8.1.25cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.0.17cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 9.1.0 < 9.1.16cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 10.0.0 < 10.0.12cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 10.1.0 < 10.1.9cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 10.2.0 < 10.2.4cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:*:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:*≥ 5.1.0 < 5.1.12cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:*≥ 5.2.0 < 5.2.13cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.0.7cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:*≥ 6.1.0 < 6.1.2cpe:2.3:a:paloaltonetworks:globalprotect:6.2.0:*:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:prisma_access:-:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Palo Alto Networks · PAN-OS | unaffected 11.1.0 ; unaffected 11.2.0 ; affected 11.0.0 < 11.0.1 ; affected 10.2.0 < 10.2.4 ; affected 10.1.0 < 10.1.9 ; affected 10.0.0 < 10.0.12 |
| Palo Alto Networks · GlobalProtect App | affected 5.1.0 < 5.1.12 ; affected 5.2.0 < 5.2.13 ; affected 6.0.0 < 6.0.7 ; affected 6.1.0 < 6.1.2 ; affected 6.2.0 < 6.2.1 ; unaffected 6.3.0 |
| Palo Alto Networks · Cloud NGFW | unaffected All |
| Palo Alto Networks · Prisma Access | affected 10.2.0 < 10.2.9 on PAN-OS |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |