title: Information Disclosure in GlobalProtect Agent
description: GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS may allow a local authenticated attacker who has compromised the end-user account and gained the ability to inspect memory, to access authentication and/or session tokens and replay them to spoof the VPN session and gain access as the user.
problem types: CWE-226 Sensitive Information Uncleared Before Release
affected:
{
platforms: Windows
product: GlobalProtect Agent
vendor: Palo Alto Networks
versions:
changes: [at: 4.1.1, status: unaffected], lessThanOrEqual: 4.1.0, status: affected, version: 4.1, versionType: custom
}
{
platforms: OS X
product: GlobalProtect Agent
vendor: Palo Alto Networks
versions:
lessThan: 4.1*, status: unaffected, version: 4.1.11, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
solutions: This issue is fixed in GlobalProtect Agent 4.1.1 and later for Windows, and GlobalProtect Agent 4.1.11 and later for macOS.