title: GlobalProtect App: Information Exposure Vulnerability When Using Connect Before Logon
description: An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the connecting GlobalProtect user when authenticating using Connect Before Logon feature. This issue impacts GlobalProtect App 5.2 versions earlier than 5.2.9 on Windows. This issue does not affect the GlobalProtect app on other platforms.
problem types: CWE-532 Information Exposure Through Log Files
affected:
{
platforms: Windows
product: GlobalProtect App
vendor: Palo Alto Networks
versions:
changes: [at: 5.2.9, status: unaffected], lessThan: 5.2.9, status: affected, version: 5.2, versionType: custom
}
{
product: GlobalProtect App
vendor: Palo Alto Networks
versions:
status: unaffected, version: 5.1.*
status: unaffected, version: 5.3.*
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
exploits: Palo Alto Networks is not aware of any malicious exploitation of this issue.
solutions: This issue is fixed in GlobalProtect app 5.2.9 on Windows and all later GlobalProtect app versions.
workarounds: There are no known workarounds for this issue.