PT-2022-12956 · Palo Alto Networks · Palo Alto Networks Globalprotect

Rutger Truyers · Published 2022-02-10 · Updated 2022-02-17 · CVE-2022-0021

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Palo Alto Networks GlobalProtect App 5.2 versions earlier than 5.2.9 on Windows

Description An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows. This issue occurs when the Connect Before Logon feature is used, resulting in the logging of cleartext credentials of the connecting GlobalProtect user. The GlobalProtect app on other platforms is not affected.

Recommendations For GlobalProtect App 5.2 versions earlier than 5.2.9 on Windows, update to version 5.2.9 or later to resolve the issue. As a temporary workaround, consider disabling the Connect Before Logon feature until a patch is available. Restrict access to log files to minimize the risk of exploitation.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2022-0021

Affected Products

Palo Alto Networks Globalprotect

References · 4

• https://osv.dev/vulnerability/CVE-2022-0021 · Vendor Advisory
• https://security.paloaltonetworks.com/CVE-2022-0021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0021 · Security Note
• https://t.me/cibsecurity/37237 · Telegram Post