title: PAN-OS: Secrets for scheduled configuration exports are logged in system logs
description: An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in system logs. Logged information includes the cleartext username, password, and IP address used to export the PAN-OS configuration to the destination server.
problem types: CWE-534 Information Exposure Through Debug Log Files
affected:
{
product: PAN-OS
vendor: Palo Alto Networks
versions:
changes: [at: 8.1.19, status: unaffected], lessThan: 8.1.19, status: affected, version: 8.1, versionType: custom
changes: [at: 9.0.13, status: unaffected], lessThan: 9.0.13, status: affected, version: 9.0, versionType: custom
changes: [at: 9.1.4, status: unaffected], lessThan: 9.1.4, status: affected, version: 9.1, versionType: custom
lessThan: 10.0*, status: unaffected, version: 10.0.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
exploits: Palo Alto Networks is not aware of any malicious exploitation of this issue.
solutions: This issue is fixed in PAN-OS 8.1.19, PAN-OS 9.0.13, PAN-OS 9.1.4, and all later PAN-OS versions.
After you upgrade the PAN-OS appliance, you must change the connection details used in scheduled configuration exports. You should also change the credentials on the destination server that are used to export the configuration.