Log in Start free

Vulnerability · Published Aug 14, 2024 · Assigned by palo_alto

CVE-2024-5916PAN-OS: Cleartext Exposure of External System Secrets

Medium 6.0

In plain English

A medium-severity security flaw in Cloud NGFW from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 4.0)6.0Medium
Exploit odds (30 days)0.2%top 83.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords, and tokens of external systems. A read-only administrator who has access to the config log, can read secrets, passwords, and tokens to external systems.

Affected products (as reported)

VendorProductVersions
Palo Alto Networks PAN-OS 10.2 – before 10.2.811.0 – before 11.0.4
Palo Alto Networks Cloud NGFW Before 8/15Before 8/23
Palo Alto Networks Prisma Access see references

Weakness: CWE-313 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber

References