An information exposure through log file vulnerability where an administrators password or other sensitive information may be logged in cleartext while using the CLI in Palo Alto Networks PAN-OS software. The opcmdhistory.log file was introduced to track operational command (op-command) usage but did not mask all sensitive information. The opcmdhistory.log file is removed in PAN-OS 9.1 and later PAN-OS versions. Command usage is recorded, instead, in the req_stats.log file in PAN-OS 9.1 and later PAN-OS versions. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3.
Weakness
The product writes sensitive information to a log file.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pan-os | Paloaltonetworks | 8.0.0 (including) | 8.0.20 (including) |
| Pan-os | Paloaltonetworks | 8.1.0 (including) | 8.1.16 (excluding) |
| Pan-os | Paloaltonetworks | 9.0.0 (including) | 9.0.10 (excluding) |
| Pan-os | Paloaltonetworks | 9.1.0 (including) | 9.1.3 (excluding) |