CVE-2022-0021
Assigner: palo_alto
Published: 2022-02-09T00:00:00
State: PUBLISHED
affected: platforms: Windows
product: GlobalProtect App
vendor: Palo Alto Networks
versions: changes: at: 5.2.9
status: unaffected
lessThan: 5.2.9
status: affected
version: 5.2
versionType: custom
product: GlobalProtect App
vendor: Palo Alto Networks
versions: status: unaffected
version: 5.1.*
status: unaffected
version: 5.3.*
configurations: value: This issue is applicable only to devices configured to use the GlobalProtect Connect Before Logon feature.
credits: value: This issue was found by Rutger Truyers of Palo Alto Networks during internal security review.
datePublic: 2022-02-09T00:00:00
descriptions: value: An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the connecting GlobalProtect user when authenticating using Connect Before Logon feature. This issue impacts GlobalProtect App 5.2 versions earlier than 5.2.9 on Windows. This issue does not affect the GlobalProtect app on other platforms.
exploits: value: Palo Alto Networks is not aware of any malicious exploitation of this issue.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-532
description: CWE-532 Information Exposure Through Log Files
type: CWE
solutions: value: This issue is fixed in GlobalProtect app 5.2.9 on Windows and all later GlobalProtect app versions.
source: defect: GPC-13888
discovery: INTERNAL
timeline: time: 2022-02-09T00:00:00
value: Initial publication
title: GlobalProtect App: Information Exposure Vulnerability When Using Connect Before Logon
workarounds: value: There are no known workarounds for this issue.
x_generator: engine: Vulnogram 0.0.9