CVE-2024-8687

PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes

At a glance

Severity: MEDIUM 6.9
EPSS: EPSS 0.41 % · percentile 35 (2026-10-27)
State: PUBLISHED
Published: 2024-09-11
Updated: 2024-09-11
Assigner: palo_alto
NVD status: Analyzed

Description

An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the GlobalProtect app configuration would not normally permit them to do so.

Scores

Version	Score	Vector	Scored by
CVSS 4.0	MEDIUM 6.9	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:M/U:Amber	palo_alto
CVSS 4.0	MEDIUM 6.9	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber	NVD · psirt@paloaltonetworks.com (Secondary)
CVSS 3.1	HIGH 7.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

CWE-497

European references

ENISA EUVD · EUVD-2024-49346
GCVE · GCVE-0-2024-8687

CERT-FR advisories

CERTFR-2024-AVI-0770 — Multiples vulnérabilités dans les produits Palo Alto Networks · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 8.1.0 < 8.1.25
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 9.0.0 < 9.0.17
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 9.1.0 < 9.1.16
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 10.0.0 < 10.0.12
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 10.1.0 < 10.1.9
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 10.2.0 < 10.2.4
cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:* ≥ 5.1.0 < 5.1.12
cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:* ≥ 5.2.0 < 5.2.13
cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:* ≥ 6.0.0 < 6.0.7
cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:* ≥ 6.1.0 < 6.1.2
cpe:2.3:a:paloaltonetworks:globalprotect:6.2.0:*:*:*:*:*:*:*
cpe:2.3:a:paloaltonetworks:prisma_access:-:*:*:*:*:*:*:*

Affected products

Product	Versions
Palo Alto Networks · PAN-OS	unaffected 11.1.0 ; unaffected 11.2.0 ; affected 11.0.0 < 11.0.1 ; affected 10.2.0 < 10.2.4 ; affected 10.1.0 < 10.1.9 ; affected 10.0.0 < 10.0.12
Palo Alto Networks · GlobalProtect App	affected 5.1.0 < 5.1.12 ; affected 5.2.0 < 5.2.13 ; affected 6.0.0 < 6.0.7 ; affected 6.1.0 < 6.1.2 ; affected 6.2.0 < 6.2.1 ; unaffected 6.3.0
Palo Alto Networks · Cloud NGFW	unaffected All
Palo Alto Networks · Prisma Access	affected 10.2.0 < 10.2.9 on PAN-OS

References

https://security.paloaltonetworks.com/CVE-2024-8687

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD