Information disclosure

An information exposure vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows and MacOS where the credentials of the local user account are sent to the GlobalProtect portal when the Single Sign-On feature is enabled in the GlobalProtect portal configuration. This product...

Design/Logic Flaw

An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the connecting GlobalProtect user when authenticating using Connect Before Logon feature. This issue impacts GlobalProtect App 5.2 versions...

CVE-2022-0021

Palo Alto Networks GlobalProtect App for Windows is affected by CVE-2022-0021. The vulnerability arises from an information exposure in the log files where cleartext credentials of the connected GlobalProtect user are logged during authentication via Connect Before Logon. Affected product/version...

CVE-2022-0021 GlobalProtect App: Information Exposure Vulnerability When Using Connect Before Logon

An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the connecting GlobalProtect user when authenticating using Connect Before Logon feature. This issue impacts GlobalProtect App 5.2 versions...

CVE-2022-0019 GlobalProtect App: Insufficiently Protected Credentials Vulnerability on Linux

An insufficiently protected credentials vulnerability exists in the Palo Alto Networks GlobalProtect app on Linux that exposes the hashed credentials of GlobalProtect users that saved their password during previous GlobalProtect app sessions to other local users on the system. The exposed...

CVE-2022-0019

The CVE-2022-0019 entry concerns Palo Alto Networks GlobalProtect App for Linux, where saved password hashes are exposed to other local users. This local-attack exposure allows an attacker to authenticate as the target user to the GlobalProtect portal/gateway without the plaintext password. Affec...

CVE-2022-0018 GlobalProtect App: Information Exposure Vulnerability When Connecting to GlobalProtect Portal With Single Sign-On Enabled

An information exposure vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows and MacOS where the credentials of the local user account are sent to the GlobalProtect portal when the Single Sign-On feature is enabled in the GlobalProtect portal configuration. This product...

CVE-2022-0018

An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on Windows and macOS allows the local user’s credentials to be sent to the GlobalProtect portal when Single Sign-On is enabled. The behavior is described as intentional; risk is present when BYOD or differing portal...

CVE-2022-0017 GlobalProtect App: Improper Link Resolution Vulnerability Leads to Local Privilege Escalation

An improper link resolution before file access 'link following' vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a local attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges under certain circumstances. This iss...

CVE-2022-0017

CVE-2022-0017 is a local privilege-escalation in the Windows GlobalProtect app caused by improper link resolution before file access. A local attacker could disrupt system processes and potentially execute arbitrary code with SYSTEM privileges under certain conditions. Affected: GlobalProtect app...

CVE-2022-0016 GlobalProtect App: Privilege Escalation Vulnerability When Using Connect Before Logon

An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Before Logon under certain circumstances...

CVE-2022-0016

CVE-2022-0016 is a privilege-escalation issue in the Palo Alto Networks GlobalProtect app, specifically in the Connect Before Logon feature. Affected: GlobalProtect app 5.2.x on Windows and macOS prior to 5.2.9. Root cause: improper handling of exceptional conditions during Connect Before Logon a...

Vulnerabilities fixed in Palo Alto GlobalProtect App

Palo Alto Networks has fixed vulnerabilities in GlobalProtect App. The vulnerabilities potentially enable a local malicious person to able to launch attacks that result in the following categories of damage: Remote code execution Administrator/Root privileges. Access to sensitive data Increased...

CVE-2022-0019

An insufficiently protected credentials vulnerability exists in the Palo Alto Networks GlobalProtect app on Linux that exposes the hashed credentials of GlobalProtect users that saved their password during previous GlobalProtect app sessions to other local users on the system. The exposed...

GlobalProtect App: Information Exposure Vulnerability When Using Connect Before Logon

An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the connecting GlobalProtect user when authenticating using Connect Before Logon feature. Work around: There are no known workarounds for thi...

CVE-2022-0016

An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Before Logon under certain circumstances...

GlobalProtect App: Privilege Escalation Vulnerability When Using Connect Before Logon With SAML Authentication

An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app when the feature is configured to use SAML authentication that enables a local attacker to escalate to SYSTEM or root privileges when...

GlobalProtect App: Improper Link Resolution Vulnerability Leads to Local Privilege Escalation

An improper link resolution before file access 'link following' vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a local attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges under certain circumstances. Work...

CVE-2022-0018

An information exposure vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows and MacOS where the credentials of the local user account are sent to the GlobalProtect portal when the Single Sign-On feature is enabled in the GlobalProtect portal configuration. This product...

CVE-2022-0017

An improper link resolution before file access 'link following' vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a local attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges under certain circumstances. This iss...