Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack Cleartext Credential Exposure Vulnerability

A vulnerability in the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack prior to version 4.6.5 on Windows can lead to the exposure of user credentials in application logs. These logs, typically accessible only to local users and included in troubleshooting log generation, inadvertently expose credentials to recipients of the application logs. This issue arises when the Microsoft 365 Defender Pack is enabled.

Impact

Exploitation of this vulnerability can result in the cleartext exposure of user credentials in application logs, which may be accessed by local users or included in logs sent for troubleshooting purposes.

Remediation

Users can upgrade to version 4.6.5 or later to address this vulnerability. Additionally, it is recommended to rotate any Client Secrets for Azure Applications that connected with the Microsoft 365 Defender Pack.