CVE-2025-4234 Cortex XDR Microsoft 365 Defender Pack: Cleartext Exposure of Credentials
Exploit Maturity
UNREPORTED
Response Effort
MODERATE
Recovery
USER
Value Density
DIFFUSE
Attack Vector
LOCAL
Attack Complexity
LOW
Attack Requirements
PRESENT
Automatable
NO
User Interaction
PASSIVE
Product Confidentiality
LOW
Product Integrity
NONE
Product Availability
NONE
Privileges Required
LOW
Subsequent Confidentiality
HIGH
Subsequent Integrity
HIGH
Subsequent Availability
HIGH
Description
A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these credentials are exposed to recipients of the application logs.
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Cortex XDR Microsoft 365 Defender Pack 4.6.0 | < 4.6.5 on Windows | >= 4.6.5 on Windows |
Required Configuration for Exposure
The Microsoft 365 Defender Pack must be enabled.
Severity: LOW, Suggested Urgency: MODERATE
CVSS-BT: 0.5 / CVSS-B: 2.4 (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:U/AU:N/R:U/V:D/RE:M/U:Amber)
Exploitation Status
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Weakness Type and Impact
CWE-532: Insertion of Sensitive Information into Log File
CAPEC-21 Exploitation of Trusted Credentials
Solution
| Version | Minor Version | Suggested Solution |
|---|---|---|
| Cortex XDR Microsoft 365 Defender Pack 4.6 on Windows |
4.6.0 through 4.6.4 | Upgrade to 4.6.5 or later. |
Rotate any Client Secrets for Azure Applications that attempted connection with the Microsoft 365 Defender Pack.
Workarounds and Mitigations
No known workarounds exist for this issue.
Acknowledgments
Palo Alto Networks thanks RC for discovering and reporting this issue.
CPE Applicability
- cpe:2.3:a:palo_alto_networks:cortex_xdr_microsoft_365_defender_pack:*:*:*:*:*:Windows:*:* is vulnerable from (including)4.6.0 and up to (excluding)4.6.5
Timeline
Initial Publication