CVE-2020-2004

GlobalProtect App: Passwords may be logged in clear text while collecting troubleshooting logs

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app (also known as GlobalProtect Agent) for MacOS and Windows. For this issue to occur all of these conditions must be true: (1) 'Save User Credential' option should be set to 'Yes' in the GlobalProtect Portal's Agent configuration, (2) the GlobalProtect user manually selects a gateway, (3) and the logging level is set to 'Dump' while collecting troubleshooting logs. This issue does not affect GlobalProtect app on other platforms (for example iOS/Android/Linux). This issue affects GlobalProtect app 5.0 versions earlier than 5.0.9, GlobalProtect app 5.1 versions earlier than 5.1.2 on Windows or MacOS. Since becoming aware of the issue, Palo Alto Networks has safely deleted all the known GlobalProtectLogs zip files sent by customers with the credentials. We now filter and remove these credentials from all files sent to Customer Support. The GlobalProtectLogs zip files uploaded to Palo Alto Networks systems were only accessible by authorized personnel with valid Palo Alto Networks credentials. We do not have any evidence of malicious access or use of these credentials.

Bajo determinadas circunstancias, la contraseña de usuario puede ser registrada en texto sin cifrar en el archivo de diagnóstico PanGPS.log cuando registros son recolectados para la solución de problemas en la aplicación GlobalProtect (también se conoce como Agente GlobalProtect) para MacOS y Windows. Para que este problema se presente, todas estas condiciones deben ser ciertas: (1) la opción "Save User Credential" debe establecerse en "Yes" en la configuración del Agente del portal de GlobalProtect, (2) el usuario de GlobalProtect selecciona manualmente una puerta de enlace, (3) y el nivel de registro se establece en "Dump" al recolectar registros de solución de problemas. Este problema no afecta a la aplicación GlobalProtect en otras plataformas (por ejemplo, iOS/Android/Linux). Este problema afecta a la aplicación GlobalProtect versiones 5.0 anteriores a 5.0.9, la aplicación GlobalProtect versiones 5.1 anteriores a 5.1.2 en Windows o MacOS. Desde que se percibió el problema, Palo Alto Networks ha eliminado de forma segura todos los archivos zip de GlobalProtectLogs conocidos enviados por los clientes con las credenciales. Ahora filtramos y eliminamos estas credenciales de todos los archivos enviados a Atención al Cliente. Los archivos zip de GlobalProtectLogs cargados en los sistemas de Palo Alto Networks solo fueron accesibles por personal autorizado con credenciales válidas de Palo Alto Networks. No tenemos evidencia de acceso malicioso o uso de estas credenciales.

*Credits: This issue was found by Navin Vasan of Palo Alto Networks during internal security review.

CVSS Scores

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Attack Vector

Local

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-12-04 CVE Reserved
2020-05-13 CVE Published
2023-03-08 EPSS Updated
2024-09-17 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-532: Insertion of Sensitive Information into Log File
CWE-534: DEPRECATED: Information Exposure Through Debug Log Files

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://security.paloaltonetworks.com/CVE-2020-2004	2020-05-15

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Paloaltonetworks Search vendor "Paloaltonetworks"		Globalprotect Search vendor "Paloaltonetworks" for product "Globalprotect"				>= 5.0.0 < 5.0.9 Search vendor "Paloaltonetworks" for product "Globalprotect" and version " >= 5.0.0 < 5.0.9"		macos		Affected
Paloaltonetworks Search vendor "Paloaltonetworks"		Globalprotect Search vendor "Paloaltonetworks" for product "Globalprotect"				>= 5.0.0 < 5.0.9 Search vendor "Paloaltonetworks" for product "Globalprotect" and version " >= 5.0.0 < 5.0.9"		windows		Affected
Paloaltonetworks Search vendor "Paloaltonetworks"		Globalprotect Search vendor "Paloaltonetworks" for product "Globalprotect"				>= 5.1.0 < 5.1.2 Search vendor "Paloaltonetworks" for product "Globalprotect" and version " >= 5.1.0 < 5.1.2"		macos		Affected
Paloaltonetworks Search vendor "Paloaltonetworks"		Globalprotect Search vendor "Paloaltonetworks" for product "Globalprotect"				>= 5.1.0 < 5.1.2 Search vendor "Paloaltonetworks" for product "Globalprotect" and version " >= 5.1.0 < 5.1.2"		windows		Affected