CVE-2024-5908: GlobalProtect App: Encrypted Credential Exposure via Log Files

Q: What is the severity of CVE-2024-5908?

CVE-2024-5908 has been rated with a medium severity level due to the potential exposure of sensitive information.

Q: How do I fix CVE-2024-5908?

To remediate CVE-2024-5908, upgrade the Palo Alto Networks GlobalProtect app to version 5.1.12 or newer, or version 6.0.8 or newer, or version 6.1.3 or newer, or version 6.2.3 or newer.

Q: What are the potential consequences of CVE-2024-5908?

The consequences of CVE-2024-5908 include unauthorized access to encrypted user credentials due to their exposure in application logs.

Q: Which versions of Palo Alto Networks GlobalProtect are affected by CVE-2024-5908?

CVE-2024-5908 affects Palo Alto Networks GlobalProtect versions prior to 5.1.12, 6.0.8, 6.1.3, and 6.2.3.

Q: Is there a workaround for CVE-2024-5908?

There is currently no documented workaround for CVE-2024-5908 other than applying the latest software updates.

Published Jun 12, 2024

Updated

A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.

Affected Software

4 affected components

Palo Alto Networks GlobalProtect>=5.1<5.1.12

Palo Alto Networks GlobalProtect>=6.0<6.0.8

Palo Alto Networks GlobalProtect>=6.1<6.1.3

Palo Alto Networks GlobalProtect>=6.2<6.2.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Palo Alto Networks GlobalProtect app to a version that resolves this vulnerability.
Fixed in 5.1.12
Upgrade
Upgrade Palo Alto Networks GlobalProtect app to a version that resolves this vulnerability.
Fixed in 6.0.8
Upgrade
Upgrade Palo Alto Networks GlobalProtect app to a version that resolves this vulnerability.
Fixed in 6.1.3
Upgrade
Upgrade Palo Alto Networks GlobalProtect app to a version that resolves this vulnerability.
Fixed in 6.2.3
Operational
Delete PanGPS.log files from the GlobalProtect installation directory on all endpoints to remove exposed encrypted credentials from application logs.
Operational
Force a rotation of user passwords that are used to connect to GlobalProtect.

Event History

Jun 12, 2024

CVE Published

via MITRE·04:28 PM

Data Sourced

via MITRE·04:28 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Apr 14, 58462

Event

via NVD·09:13 PM

Frequently Asked Questions

What is the severity of CVE-2024-5908?

CVE-2024-5908 has been rated with a medium severity level due to the potential exposure of sensitive information.

How do I fix CVE-2024-5908?

To remediate CVE-2024-5908, upgrade the Palo Alto Networks GlobalProtect app to version 5.1.12 or newer, or version 6.0.8 or newer, or version 6.1.3 or newer, or version 6.2.3 or newer.

What are the potential consequences of CVE-2024-5908?

The consequences of CVE-2024-5908 include unauthorized access to encrypted user credentials due to their exposure in application logs.

Which versions of Palo Alto Networks GlobalProtect are affected by CVE-2024-5908?