CVE-2020-2004

Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app (also known as GlobalProtect Agent) for MacOS and Windows. For this issue to occur all of these conditions must be true: (1) 'Save User Credential' option should be set to 'Yes' in the GlobalProtect Portal's Agent configuration, (2) the GlobalProtect user manually selects a gateway, (3) and the logging level is set to 'Dump' while collecting troubleshooting logs. This issue does not affect GlobalProtect app on other platforms (for example iOS/Android/Linux). This issue affects GlobalProtect app 5.0 versions earlier than 5.0.9, GlobalProtect app 5.1 versions earlier than 5.1.2 on Windows or MacOS. Since becoming aware of the issue, Palo Alto Networks has safely deleted all the known GlobalProtectLogs zip files sent by customers with the credentials. We now filter and remove these credentials from all files sent to Customer Support. The GlobalProtectLogs zip files uploaded to Palo Alto Networks systems were only accessible by authorized personnel with valid Palo Alto Networks credentials. We do not have any evidence of malicious access or use of these credentials.

• CWE-534
• CWE-532

• https://security.paloaltonetworks.com/CVE-2020-2004Mitigation, Vendor Advisory
• https://security.paloaltonetworks.com/CVE-2020-2004Mitigation, Vendor Advisory

Published

May 13, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-2000An OS command injection and memory corruption vulnerability …7.2
• CVE-2020-2001An external control of path and data vulnerability in the Pa…9.8
• CVE-2020-20012WebPlus Pro v1.4.7.8.4-01 is vulnerable to Incorrect Access …9.8
• CVE-2020-2002An authentication bypass by spoofing vulnerability exists in…8.1
• CVE-2020-20021An issue discovered in MikroTik Router v6.46.3 and earlier a…7.5
• CVE-2020-2003An external control of filename vulnerability in the command…6.5
• CVE-2020-2005A cross-site scripting (XSS) vulnerability exists when visit…6.1
• CVE-2020-2006A stack-based buffer overflow vulnerability in the managemen…8.8
• CVE-2020-20067File upload vulnerability in ebCMS v.1.1.0 allows a remote a…8.8
• CVE-2020-2007An OS command injection vulnerability in the management serv…7.2
• CVE-2020-20070Cross Site Scripting vulnerability found in wkeyuan DWSurvey…6.1
• CVE-2020-2008An OS command injection and external control of filename vul…7.2