CVE-2020-2043: PAN-OS: Passwords may be logged in clear text when using after-change-detail custom syslog field for config logs
First published: Wed Sep 09 2020(Updated: )
An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-OS software when the after-change-detail custom syslog field is enabled for configuration logs and the sensitive field appears multiple times in one log entry. The first instance of the sensitive field is masked but subsequent instances are left in clear text. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4.
Credit: psirt@paloaltonetworks.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Paloaltonetworks Pan-os | >=8.1.0<=8.1.15 | |
| Paloaltonetworks Pan-os | >=9.0.0<9.0.10 | |
| Paloaltonetworks Pan-os | >=9.1.0<9.1.4 |
Remedy
This issue is fixed in PAN-OS 8.1.16, PAN-OS 9.0.10, PAN-OS 9.1.4, and all later PAN-OS versions.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-2043?
CVE-2020-2043 is an information exposure through log file vulnerability in Palo Alto Networks PAN-OS software.
How does CVE-2020-2043 vulnerability work?
CVE-2020-2043 allows sensitive fields to be recorded in the configuration log without proper masking.
What is the severity of CVE-2020-2043?
The severity of CVE-2020-2043 is medium with a severity value of 3.3.
Which versions of Palo Alto Networks PAN-OS are affected?
Versions 8.1.0 to 8.1.15, 9.0.0 to 9.0.10, and 9.1.0 to 9.1.4 of Palo Alto Networks PAN-OS are affected.
How can I fix CVE-2020-2043?
To fix CVE-2020-2043, upgrade to a version of Palo Alto Networks PAN-OS that is not affected by this vulnerability.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/remedy
- agent/references
- agent/weakness
- agent/severity
- agent/title
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/paloaltonetworks
- canonical/paloaltonetworks pan-os
- version/paloaltonetworks pan-os/8.1.0
- version/paloaltonetworks pan-os/8.1.15
- version/paloaltonetworks pan-os/9.0.0
- version/paloaltonetworks pan-os/9.1.0