PT-2024-37238 · Palo Alto Networks · Pan-Os
CVSS v4.0
6.0
Medium
| Vector | AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber |
Name of the Vulnerable Software and Affected Versions:
Palo Alto Networks PAN-OS versions prior to 10.2.8
Palo Alto Networks PAN-OS versions prior to 11.0.4
Description:
An information exposure issue in the software enables a local system administrator to unintentionally disclose secrets, passwords, and tokens of external systems. A read-only administrator with access to the config log can read these sensitive details.
Recommendations:
For versions prior to 10.2.8, update to version 10.2.8 or later.
For versions prior to 11.0.4, update to version 11.0.4 or later.
As a temporary workaround, consider restricting access to the config log to minimize the risk of exploitation.
Fix
Cleartext Storage of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pan-Os