CVE-2024-5908 Vulnerability Details

  /     /     /  

CVE-2024-5908 Metadata Quick Info

CVE Published: 12/06/2024 | CVE Updated: 09/08/2024 | CVE Year: 2024
Source: palo_alto | Vendor: Palo Alto Networks | Product: GlobalProtect App
Status : PUBLISHED

---

CVE-2024-5908 Description

A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-532
CWE Name: CWE-532: Insertion of Sensitive Information into Log File
Source: Palo Alto Networks

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-150
CAPEC Description: CAPEC-150 Collect Data from Common Resource Locations


Source: NVD (National Vulnerability Database).