CVE-2020-2043

LOW Year: 2020
CVSS v3 Score
3.3
Low
CVSS v2 Score
4.0
Medium
Weakness Type
CWE-532
View all →

Vulnerability Description

An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-OS software when the after-change-detail custom syslog field is enabled for configuration logs and the sensitive field appears multiple times in one log entry. The first instance of the sensitive field is masked but subsequent instances are left in clear text. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4.

Related Vulnerabilities

CVE-2016-0296

LOW
CVSS:3.3(Low)

IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available to a local user.

CWE-5322016

CVE-2016-5432

LOW
CVSS:3.3(Low)

The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files.

CWE-5322016

CVE-2017-1733

LOW
CVSS:3.3(Low)

IBM QRadar 7.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 134914.

CWE-5322017

CVE-2017-18423

LOW
CVSS:3.3(Low)

In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273).

CWE-5322017

CVE-2018-5693

LOW
CVSS:3.3(Low)

The LinuxMagic MagicSpam extension before 2.0.14-1 for Plesk allows local users to discover mailbox names by reading /var/log/magicspam/mslog.

CWE-5322018

CVE-2019-10343

LOW
CVSS:3.3(Low)

Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configuration being applied.

CWE-5322019