CVE-2022-0018

An information exposure vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows and MacOS where the credentials of the local user account are sent to the GlobalProtect portal when the Single Sign-On feature is enabled in the GlobalProtect portal configuration. This product behavior is intentional and poses no security risk when connecting to trusted GlobalProtect portals configured to use the same Single Sign-On credentials both for the local user account as well as the GlobalProtect login. However when the credentials are different, the local account credentials are inadvertently sent to the GlobalProtect portal for authentication. A third party MITM type of attacker cannot see these credentials in transit. This vulnerability is a concern where the GlobalProtect app is deployed on Bring-your-Own-Device (BYOD) type of clients with private local user accounts or GlobalProtect app is used to connect to different organizations. Fixed versions of GlobalProtect app have an app setting to prevent the transmission of the user's local user credentials to the target GlobalProtect portal regardless of the portal configuration. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.10 on Windows and MacOS; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.9 on Windows and MacOS This issue does not affect GlobalProtect app on other platforms.

• CWE-201
• CWE-200

• https://security.paloaltonetworks.com/CVE-2022-0018Mitigation, Vendor Advisory
• https://security.paloaltonetworks.com/CVE-2022-0018Mitigation, Vendor Advisory

Published

Feb 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-0012An improper link resolution before file access vulnerability…7.1
• CVE-2022-0013A file information exposure vulnerability exists in the Palo…5.5
• CVE-2022-0014An untrusted search path vulnerability exists in the Palo Al…7.3
• CVE-2022-0015A local privilege escalation (PE) vulnerability exists in th…7.8
• CVE-2022-0016An improper handling of exceptional conditions vulnerability…7.8
• CVE-2022-0017An improper link resolution before file access ('link follow…7.8
• CVE-2022-0019An insufficiently protected credentials vulnerability exists…5.5
• CVE-2022-0020A stored cross-site scripting (XSS) vulnerability in Palo Al…5.4
• CVE-2022-0021An information exposure through log file vulnerability exist…5.5
• CVE-2022-0022Usage of a weak cryptographic algorithm in Palo Alto Network…4.4
• CVE-2022-0023An improper handling of exceptional conditions vulnerability…5.9
• CVE-2022-0024A vulnerability exists in Palo Alto Networks PAN-OS software…7.2