high
7.5
CWE
532
EPSS
0.087%
Advisory Published
Updated

CVE-2024-5908: GlobalProtect App: Encrypted Credential Exposure via Log Files

First published: Wed Jun 12 2024(Updated: )

A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.

Credit: psirt@paloaltonetworks.com

Affected SoftwareAffected VersionHow to fix
Palo Alto Networks GlobalProtect UWP App>=5.1<5.1.12
Palo Alto Networks GlobalProtect UWP App>=6.0<6.0.8
Palo Alto Networks GlobalProtect UWP App>=6.1<6.1.3
Palo Alto Networks GlobalProtect UWP App>=6.2<6.2.3

Remedy

This issue is fixed in GlobalProtect app 5.1.12, GlobalProtect app 6.0.8, GlobalProtect app 6.1.3, GlobalProtect app 6.2.3, and all later GlobalProtect app versions. Customers looking to protect against the impact of this encrypted password disclosure should first delete PanGPS.log files from the GlobalProtect installation directory on all endpoints and then force a rotation of user passwords that are used to connect to GlobalProtect.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2024-5908?

    CVE-2024-5908 has been rated with a medium severity level due to the potential exposure of sensitive information.

  • How do I fix CVE-2024-5908?

    To remediate CVE-2024-5908, upgrade the Palo Alto Networks GlobalProtect app to version 5.1.12 or newer, or version 6.0.8 or newer, or version 6.1.3 or newer, or version 6.2.3 or newer.

  • What are the potential consequences of CVE-2024-5908?

    The consequences of CVE-2024-5908 include unauthorized access to encrypted user credentials due to their exposure in application logs.

  • Which versions of Palo Alto Networks GlobalProtect are affected by CVE-2024-5908?

    CVE-2024-5908 affects Palo Alto Networks GlobalProtect versions prior to 5.1.12, 6.0.8, 6.1.3, and 6.2.3.

  • Is there a workaround for CVE-2024-5908?

    There is currently no documented workaround for CVE-2024-5908 other than applying the latest software updates.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203