Loading HuntDB...

CVE-2025-4234

UNKNOWN
Published 2025-09-12T17:18:11.618Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2025-4234. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these credentials are exposed to recipients of the application logs.

Understanding This Vulnerability

This Common Vulnerabilities and Exposures (CVE) entry provides detailed information about a security vulnerability that has been publicly disclosed. CVEs are standardized identifiers assigned by MITRE Corporation to track and catalog security vulnerabilities across software and hardware products.

The severity rating (UNKNOWN) indicates the potential impact of this vulnerability based on the CVSS (Common Vulnerability Scoring System) framework. Higher severity ratings typically indicate vulnerabilities that could lead to more significant security breaches if exploited. Security teams should prioritize remediation efforts based on severity, exploit availability, and the EPSS (Exploit Prediction Scoring System) score, which predicts the likelihood of exploitation in the wild.

If this vulnerability affects products or systems in your infrastructure, we recommend reviewing the affected products section, checking for available patches or updates from vendors, and implementing recommended workarounds or solutions until a permanent fix is available. Organizations should also monitor security advisories and threat intelligence feeds for updates about active exploitation of this vulnerability.

Available Exploits

No exploits available for this CVE.

Related News

CVE-2025-4235 User-ID Credential Agent: Cleartext Exposure of Service Account password (Severity: MEDIUM)

Related content: CVE-2025-4234 Cortex XDR Microsoft 365 Defender Pack: Cleartext Exposure of Credentials (Severity: LOW) CVE-2023-48795 Impact of Terrapin SSH Attack (Severity: MEDIUM) CVE-2025-0128 PAN-OS: Firewall Denial of Service (DoS) Using a Specially C…

Paloaltonetworks.com 2025-09-10 16:00
CVE-2025-4234 Cortex XDR Microsoft 365 Defender Pack: Cleartext Exposure of Credentials (Severity: LOW)

Related content: CVE-2025-4235 User-ID Credential Agent: Cleartext Exposure of Service Account password (Severity: MEDIUM) CVE-2023-48795 Impact of Terrapin SSH Attack (Severity: MEDIUM) CVE-2025-0128 PAN-OS: Firewall Denial of Service (DoS) Using a Specially…

Paloaltonetworks.com 2025-09-10 16:00

Affected Products

References

Workarounds

No known workarounds exist for this issue.

Solutions

Version
Minor Version
Suggested Solution

Cortex XDR Microsoft 365 Defender Pack 4.6 on Windows

4.6.0 through 4.6.4
Upgrade to 4.6.5 or later.

Rotate any Client Secrets for Azure Applications that attempted connection with the Microsoft 365 Defender Pack.

Credits & Acknowledgments

finder

RC

Timeline

Initial Publication

EU Vulnerability Database

Monitored by ENISA for EU cybersecurity

EU Coordination

EU Coordinated

Exploitation Status

No Known Exploitation

ENISA Analysis

Malicious code in bioql (PyPI)

Affected Products (ENISA)

palo alto networks
cortex xdr microsoft 365 defender pack

ENISA Scoring

CVSS Score (4.0)

2.4
/10
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/AU:N/R:U/V:D/RE:M/U:Amber

EPSS Score

0.020
probability

Data provided by ENISA EU Vulnerability Database. Last updated: October 3, 2025

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

⚠ Unreviewed LOW

GHSA-mmc8-8j7m-rcwj

Advisory Details

A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these credentials are exposed to recipients of the application logs.

CVSS Scoring

CVSS Score

2.5

CVSS Vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber

Advisory provided by GitHub Security Advisory Database. Published: September 12, 2025, Modified: September 12, 2025

References

Published: 2025-09-12T17:18:11.618Z
Last Modified: 2025-09-13T03:55:39.594Z
Copied to clipboard!