Riskcovery

CVE-2024-8687

PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes

State
Published
Severity
6.9 Medium
Published
Sep 11, 2024
Updated
Sep 11, 2024
Reserved
Sep 11, 2024

Read the record on cve.org

Description

An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the GlobalProtect app configuration would not normally permit them to do so.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:M/U:Amberpalo_alto

Weaknesses

  • CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

Affected Products

ProductVersions
PAN-OSPalo Alto Networks
  • 11.1.0Not affected
  • 11.2.0Not affected
  • 11.0.0 to before 11.0.1Affectedfrom 11.0.1Not affected
  • 10.2.0 to before 10.2.4Affectedfrom 10.2.4Not affected
  • 10.1.0 to before 10.1.9Affectedfrom 10.1.9Not affected
  • 10.0.0 to before 10.0.12Affectedfrom 10.0.12Not affected
  • 9.1.0 to before 9.1.16Affectedfrom 9.1.16Not affected
  • 9.0.0 to before 9.0.17Affectedfrom 9.0.17Not affected
  • 8.1.0 to before 8.1.25Affectedfrom 8.1.25Not affected
GlobalProtect AppPalo Alto Networks
  • 5.1.0 to before 5.1.12Affectedfrom 5.1.12Not affected
  • 5.2.0 to before 5.2.13Affectedfrom 5.2.13Not affected
  • 6.0.0 to before 6.0.7Affectedfrom 6.0.7Not affected
  • 6.1.0 to before 6.1.2Affectedfrom 6.1.2Not affected
  • 6.2.0 to before 6.2.1Affectedfrom 6.2.1Not affected
  • 6.3.0Not affected
Cloud NGFWPalo Alto Networks
  • AllNot affected
Prisma AccessPalo Alto Networks
  • 10.2.0 to before 10.2.9 on PAN-OSAffectedfrom 10.2.9 on PAN-OSNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.