CVE-2024-5916: PAN-OS: Cleartext Exposure of External System Secrets (Severity: MEDIUM)

Published Aug 14, 2024

Updated

An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords, and tokens of external systems. A read-only administrator who has access to the config log, can read secrets, passwords, and tokens to external systems.

Affected Software

5 affected componentsFixes available

Palo Alto Networks PAN-OS>=10.2.0<10.2.8

Palo Alto Networks PAN-OS>=11.0.0<11.0.4

Palo Alto Networks Cloud NGFW

Palo Alto Networks PAN-OS<11.0.4, =11.0.0, <10.2.7-h13, =10.2.0

11.0.410.2.810.2.7-h13

Palo Alto Networks Prisma Access

Remediation

Information

This issue is fixed in PAN-OS 10.2.8, PAN-OS 11.0.4, and all later PAN-OS versions. This issue is fixed in Cloud NGFW on or after 8/15 on Azure, Cloud NGFW on or after 8/23 on AWS, and all later Cloud NGFW versions. You should also revoke the secrets, passwords, and tokens that are configured in all server profiles of affected PAN-OS firewalls (Device > Server Profiles) after upgrading PAN-OS.

Mitigation

No known workarounds or mitigations exist for this issue.

Event History

Aug 14, 2024

Advisory Published

via Palo Alto Networks·04:00 PM

CVE Published

via MITRE·04:41 PM

Data Sourced

via MITRE·04:41 PM

RemedyDescriptionWeakness

Apr 30, 2025

Advisory Published

via Palo Alto Networks·06:00 PM

Frequently Asked Questions

What is the severity of CVE-2024-5916?

CVE-2024-5916 is classified as an information exposure vulnerability which can lead to the disclosure of sensitive data.

How do I fix CVE-2024-5916?

To mitigate CVE-2024-5916, upgrade to PAN-OS versions 10.2.9 or 11.0.5 or later, which include the necessary patches.

Who is affected by CVE-2024-5916?

CVE-2024-5916 affects local system administrators with read-only access to the config log on Palo Alto Networks PAN-OS versions 10.2.0 to 10.2.8 and 11.0.0 to 11.0.4.

What data can be exposed by CVE-2024-5916?

CVE-2024-5916 can lead to the unintentional exposure of secrets, passwords, and tokens of external systems.

Is there a workaround for CVE-2024-5916?

Currently, the best recommendation for CVE-2024-5916 is to apply the software updates, as no specific workaround is available.