Vulnerability · Published Feb 10, 2022 · Assigned by palo_alto

CVE-2022-0021GlobalProtect App: Information Exposure Vulnerability When Using Connect Before Logon

Low 3.3

In plain English

A low-severity sensitive data in logs in GlobalProtect App from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.2%top 86.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the connecting GlobalProtect user when authenticating using Connect Before Logon feature. This issue impacts GlobalProtect App 5.2 versions earlier than 5.2.9 on Windows. This issue does not affect the GlobalProtect app on other platforms.

Affected products (as reported)

Vendor	Product	Versions
Palo Alto Networks	GlobalProtect App	5.2 – before 5.2.9
Palo Alto Networks	GlobalProtect App	see references

Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://security.paloaltonetworks.com/CVE-2022-0021 x_refsource_MISC