CVE-2024-5908 GlobalProtect App: Encrypted Credential Exposure via Log Files
Attackers with access to application logs can view encrypted user credentials, potentially leading to credential exposure if encryption is weak or broken.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-5908?
CVE-2024-5908 is a medium-severity vulnerability in Palo Alto Networks GlobalProtect App, published on 12 Jun 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.
Weakness: CWE-532
Which versions are affected by CVE-2024-5908?
It affects 1 product.
Products include Paloaltonetworks Globalprotect.
How do I fix CVE-2024-5908?
No fix has been published for CVE-2024-5908 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-5908 being exploited?
There is no known exploitation of CVE-2024-5908 in the wild and no public exploit code.
Other vulnerabilities in Palo Alto Networks GlobalProtect App
- CVE-2025-4232 GlobalProtect: Authenticated Code Injection Through Wildcard on macOS
- CVE-2021-3057 GlobalProtect App: Buffer Overflow Vulnerability When Connecting to Portal or Gateway
- CVE-2023-0009 GlobalProtect App: Local Privilege Escalation (PE) Vulnerability
- CVE-2022-0016 GlobalProtect App: Privilege Escalation Vulnerability When Using Connect Before Logon
- CVE-2025-0120 GlobalProtect App: Local Privilege Escalation (PE) Vulnerability
Sources
Also known as GHSA-6q37-cp6x-mhfw.