GlobalProtect App: Insufficiently Protected Credentials Vulnerability on Linux
CVE-2022-0019

4.7MEDIUM

Key Information:

Vendor
Palo Alto Networks
Status
Globalprotect App
Vendor
CVE Published:
10 February 2022

Badges

đź‘ľ Exploit Exists

Summary

An insufficiently protected credentials vulnerability exists in the Palo Alto Networks GlobalProtect app on Linux that exposes the hashed credentials of GlobalProtect users that saved their password during previous GlobalProtect app sessions to other local users on the system. The exposed credentials enable a local attacker to authenticate to the GlobalProtect portal or gateway as the target user without knowing of the target user’s plaintext password. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.10 on Linux. GlobalProtect app 5.2 versions earlier than and including GlobalProtect app 5.2.7 on Linux. GlobalProtect app 5.3 versions earlier than GlobalProtect app 5.3.2 on Linux. This issue does not affect the GlobalProtect app on other platforms.

Affected Version(s)

GlobalProtect App Linux 5.3 < 5.3.2

GlobalProtect App Linux 5.2 <= 5.2.7

GlobalProtect App Linux 5.1 < 5.1.10

References

https://security.paloaltonetworks.com/CVE-2022-0019
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • đź‘ľ

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Palo Alto Networks thanks Josh Wisely and Praveen Bomma of Splunk for discovering and reporting this issue.
.