CVE-2024-5908Medium

CVE-2024-5908 GlobalProtect App: Encrypted Credential Exposure via Log Files

Published
June 12, 2024
Last Modified
August 14, 2024

🔗 CVE IDs covered (1)

CVE-2024-5908 →

📋 Description

A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.

🎯 Affected products1

  • GlobalProtect App

✅ Remediation

This issue is fixed in GlobalProtect app 5.1.12, GlobalProtect app 6.0.8, GlobalProtect app 6.1.3, GlobalProtect app 6.2.3, and all later GlobalProtect app versions. Customers looking to protect against the impact of this encrypted password disclosure should first delete PanGPA.log files from the GlobalProtect installation directory on all endpoints and then force a rotation of user passwords that are used to connect to GlobalProtect.

🔗 References (1)