Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
1 versions earlier than GlobalProtect app 5.1.8; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.4. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3038
CVE ID: CVE-2021-3039 State: PUBLISHED Published: 2021-06-10T12:33:06.234748Z Last Updated: 2024-09-17T01:50:54.050Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: Palo Alto Networks Products: Prisma Cloud Compute Problem Types: CWE-532 Description: An information exposure through log file vulnerability exists in the Palo Alto Networks Prisma Cloud Compute Console where a secret used to authorize the role of the authenticated user is logged to a debug log file. Authenticated Operator role and Auditor role users with access to the debug log files can use this secret to gain Administrator role access for their active session in Prisma Cloud Compute. Prisma Cloud
les can use this secret to gain Administrator role access for their active session in Prisma Cloud Compute. Prisma Cloud Compute SaaS versions were automatically upgraded to the fixed release. This issue impacts all Prisma Cloud Compute versions earlier than Prisma Cloud Compute 21.04.412. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3039
CVE ID: CVE-2021-3040 State: PUBLISHED Published: 2021-06-10T12:33:06.414583Z Last Updated: 2024-09-16T18:23:39.787Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Palo Alto Networks Products: Bridgecrew Checkov Problem Types: CWE-502 Description: An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.139. Checkov 1.0 versions are not impacted. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3040
CVE ID: CVE-2021-3041 State: PUBLISHED Published: 2021-06-10T12:33:06.552120Z Last Updated: 2024-09-16T22:01:54.695Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: Cortex XDR Agent Problem Types: CWE-427 Description: A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory or to manipulate key registry values. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.1
to manipulate key registry values. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.11; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.8; Cortex XDR agent 7.2 versions earlier than Cortex XDR agent 7.2.3; All versions of Cortex XDR agent 7.2 without content update release 171 or a later version. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3041
CVE ID: CVE-2021-3042 State: PUBLISHED Published: 2021-07-15T16:45:12.285628Z Last Updated: 2024-09-17T04:18:46.587Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: Cortex XDR Agent Problem Types: CWE-427 Description: A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. Exploiting this vulnerability requires the user to have file creation privilege in the Windows root directory (such as C:\). This issue impacts: All versions of Cortex XDR agent 6.1 without content update 181
ndows root directory (such as C:\). This issue impacts: All versions of Cortex XDR agent 6.1 without content update 181 or a later version; All versions of Cortex XDR agent 7.2 without content update 181 or a later version; All versions of Cortex XDR agent 7.3 without content update 181 or a later version. Cortex XDR agent 5.0 versions are not impacted by this issue. Content updates are required to resolve this issue and are automatically applied for the agent. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3042
CVE ID: CVE-2021-3043 State: PUBLISHED Published: 2021-07-15T16:45:13.845939Z Last Updated: 2024-09-17T01:21:53.231Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: Prisma Cloud Compute Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console while an authenticated administrator is using that web interface. Prisma Cloud Compute SaaS versions were automatically upgraded to the fixed release. No additional action is required for these instances. This issue i
ons were automatically upgraded to the fixed release. No additional action is required for these instances. This issue impacts: Prisma Cloud Compute 20.12 versions earlier than Prisma Cloud Compute 20.12.552; Prisma Cloud Compute 21.04 versions earlier than Prisma Cloud Compute 21.04.439. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3043
CVE ID: CVE-2021-3044 State: PUBLISHED Published: 2021-06-22T17:15:11.305119Z Last Updated: 2024-09-16T17:23:37.359Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: Cortex XSOAR Problem Types: CWE-285 Description: An improper authorization vulnerability in Palo Alto Networks Cortex XSOAR enables a remote unauthenticated attacker with network access to the Cortex XSOAR server to perform unauthorized actions through the REST API. This issue impacts: Cortex XSOAR 6.1.0 builds later than 1016923 and earlier than 1271064; Cortex XSOAR 6.2.0 builds earlier than 1271065. This issue does not impact Cortex XSOAR 5.5.0, Cortex XSOAR 6.0.
271064; Cortex XSOAR 6.2.0 builds earlier than 1271065. This issue does not impact Cortex XSOAR 5.5.0, Cortex XSOAR 6.0.0, Cortex XSOAR 6.0.1, or Cortex XSOAR 6.0.2 versions. All Cortex XSOAR instances hosted by Palo Alto Networks are upgraded to resolve this vulnerability. No additional action is required for these instances. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3044
CVE ID: CVE-2021-3045 State: PUBLISHED Published: 2021-08-11T17:10:14.663259Z Last Updated: 2024-09-16T23:35:37.560Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-88 Description: An OS command argument injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.19; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.10. PAN-OS 10.0 and later versions are not impacted. Additional Analyst Notes: - CVE Pro
ersions earlier than PAN-OS 9.1.10. PAN-OS 10.0 and later versions are not impacted. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3045
CVE ID: CVE-2021-3046 State: PUBLISHED Published: 2021-08-11T17:10:16.244759Z Last Updated: 2024-09-17T02:47:06.271Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-287 Description: An improper authentication vulnerability exists in Palo Alto Networks PAN-OS software that enables a SAML authenticated attacker to impersonate any other user in the GlobalProtect Portal and GlobalProtect Gateway when they are configured to use SAML authentication. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.19; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.9;
lier than PAN-OS 8.1.19; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.9; PAN-OS 10.0 versions earlier than PAN-OS 10.0.5. PAN-OS 10.1 versions are not impacted. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3046
CVE ID: CVE-2021-3047 State: PUBLISHED Published: 2021-08-11T17:10:17.831915Z Last Updated: 2024-09-17T02:32:37.786Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-338 Description: A cryptographically weak pseudo-random number generator (PRNG) is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an authenticated attacker, with the capability to observe their own authentication secrets over a long duration on the PAN-OS appliance, to impersonate another authenticated web interface administrator's session. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.
ther authenticated web interface administrator's session. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.19; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.10; PAN-OS 10.0 versions earlier than PAN-OS 10.0.4. PAN-OS 10.1 versions are not impacted. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3047
CVE ID: CVE-2021-3048 State: PUBLISHED Published: 2021-08-11T17:10:19.346151Z Last Updated: 2024-09-16T19:31:48.430Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-20 Description: Certain invalid URL entries contained in an External Dynamic List (EDL) cause the Device Server daemon (devsrvr) to stop responding. This condition causes subsequent commits on the firewall to fail and prevents administrators from performing commits and configuration changes even though the firewall remains otherwise functional. If the firewall then restarts, it results in a denial-of-service (DoS) condition and the firewall s
therwise functional. If the firewall then restarts, it results in a denial-of-service (DoS) condition and the firewall stops processing traffic. This issue impacts: PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.9; PAN-OS 10.0 versions earlier than PAN-OS 10.0.5. PAN-OS 8.1 and PAN-OS 10.1 versions are not impacted. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-3048
CVE ID: CVE-2021-3049 State: PUBLISHED Published: 2021-09-08T17:10:14.957161Z Last Updated: 2024-09-16T20:58:16.361Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Palo Alto Networks Products: Cortex XSOAR Problem Types: CWE-285 Description: An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read permissions to download files from incident investigations of which they are aware but are not a part of. This issue impacts: All Cortex XSOAR 5.5.0 builds; Cortex XSOAR 6.1.0 builds earlier than 12099345. This issue does not impact Cortex XSOAR 6.2.0 versions. Additi
builds; Cortex XSOAR 6.1.0 builds earlier than 12099345. This issue does not impact Cortex XSOAR 6.2.0 versions. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3049
CVE ID: CVE-2021-3050 State: PUBLISHED Published: 2021-08-11T17:10:20.968755Z Last Updated: 2024-09-16T22:51:48.059Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-78 Description: An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 9.0 version 9.0.10 through PAN-OS 9.0.14; PAN-OS 9.1 version 9.1.4 through PAN-OS 9.1.10; PAN-OS 10.0 version 10.0.7 and earlier PAN-OS 10.0 versions; PAN-OS 10.1 version 10.1.0 through PAN-OS 10.1.1. Prisma Access firewalls
rsion 10.0.7 and earlier PAN-OS 10.0 versions; PAN-OS 10.1 version 10.1.0 through PAN-OS 10.1.1. Prisma Access firewalls and firewalls running PAN-OS 8.1 versions are not impacted by this issue. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3050
CVE ID: CVE-2021-3051 State: PUBLISHED Published: 2021-09-08T17:10:16.586949Z Last Updated: 2024-09-17T01:10:46.128Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: Cortex XSOAR Problem Types: CWE-347 Description: An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based attacker with specific knowledge of the Cortex XSOAR instance to access protected resources and perform unauthorized actions on the Cortex XSOAR server. This issue impacts: Cortex XSOAR 5.5.0 builds earlier than 1578677; Cortex XSOAR 6.0.2 builds earlier than 1576452; C
r. This issue impacts: Cortex XSOAR 5.5.0 builds earlier than 1578677; Cortex XSOAR 6.0.2 builds earlier than 1576452; Cortex XSOAR 6.1.0 builds earlier than 1578663; Cortex XSOAR 6.2.0 builds earlier than 1578666. All Cortex XSOAR instances hosted by Palo Alto Networks are protected from this vulnerability; no additional action is required for these instances. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3051
CVE ID: CVE-2021-3052 State: PUBLISHED Published: 2021-09-08T17:10:18.120492Z Last Updated: 2024-09-16T20:02:59.171Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability in the Palo Alto Network PAN-OS web interface enables an authenticated network-based attacker to mislead another authenticated PAN-OS administrator to click on a specially crafted link that performs arbitrary actions in the PAN-OS web interface as the targeted authenticated administrator. This issue impacts: PAN-OS 8.1 versions earlier than 8.1.20; PAN-OS 9.0 versions earlier th
authenticated administrator. This issue impacts: PAN-OS 8.1 versions earlier than 8.1.20; PAN-OS 9.0 versions earlier than 9.0.14; PAN-OS 9.1 versions earlier than 9.1.10; PAN-OS 10.0 versions earlier than 10.0.2. This issue does not affect Prisma Access. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3052
CVE ID: CVE-2021-3053 State: PUBLISHED Published: 2021-09-08T17:10:19.646975Z Last Updated: 2024-09-16T16:17:55.225Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-755 Description: An improper handling of exceptional conditions vulnerability exists in the Palo Alto Networks PAN-OS dataplane that enables an unauthenticated network-based attacker to send specifically crafted traffic through the firewall that causes the service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts:
al of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.9; PAN-OS 10.0 versions earlier than PAN-OS 10.0.5. This issue does not affect Prisma Access. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3053
CVE ID: CVE-2021-3054 State: PUBLISHED Published: 2021-09-08T17:10:21.284661Z Last Updated: 2024-09-16T23:40:41.903Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-367 Description: A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permission to upload plugins to execute arbitrary code with root user privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earl
AN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earlier than PAN-OS 10.0.7; PAN-OS 10.1 versions earlier than PAN-OS 10.1.2. This issue does not affect Prisma Access. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3054
CVE ID: CVE-2021-3055 State: PUBLISHED Published: 2021-09-08T17:10:22.809239Z Last Updated: 2024-09-17T00:30:33.926Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-611 Description: An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system and send a specifically crafted request to the firewall that causes the service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting i
attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.10; PAN-OS 10.0 versions earlier than PAN-OS 10.0.6. This issue does not affect Prisma Access. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3055
CVE ID: CVE-2021-3056 State: PUBLISHED Published: 2021-11-10T17:10:20.024857Z Last Updated: 2024-09-16T20:36:56.323Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS, Prisma Access Problem Types: CWE-120 Description: A memory corruption vulnerability in Palo Alto Networks PAN-OS GlobalProtect Clientless VPN enables an authenticated attacker to execute arbitrary code with root user privileges during SAML authentication. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.9; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1
rlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.9; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1. Prisma Access customers with Prisma Access 2.1 Preferred firewalls are impacted by this issue. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3056
CVE ID: CVE-2021-3057 State: PUBLISHED Published: 2021-10-13T16:10:10.405531Z Last Updated: 2024-09-17T01:35:48.767Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: GlobalProtect App Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect app that enables a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.9 on Windows; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.8 on Windows; GlobalProtec
otect app 5.1.9 on Windows; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.8 on Windows; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.8 on the Universal Windows Platform; GlobalProtect app 5.3 versions earlier than GlobalProtect app 5.3.1 on Linux. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3057
CVE ID: CVE-2021-3058 State: PUBLISHED Published: 2021-11-10T17:10:21.556749Z Last Updated: 2024-09-16T22:52:16.389Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS, Prisma Access Problem Types: CWE-78 Description: An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permissions to use XML API the ability to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 version
AN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. This issue does not impact Prisma Access firewalls. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3058
CVE ID: CVE-2021-3059 State: PUBLISHED Published: 2021-11-10T17:10:23.093770Z Last Updated: 2024-09-16T17:03:16.819Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS, Prisma Access Problem Types: CWE-78 Description: An OS command injection vulnerability in the Palo Alto Networks PAN-OS management interface exists when performing dynamic updates. This vulnerability enables a man-in-the-middle attacker to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2;
PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers that have Prisma Access 2.1 Preferred or Prisma Access 2.1 Innovation firewalls are impacted by this issue. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3059
CVE ID: CVE-2021-3060 State: PUBLISHED Published: 2021-11-10T17:10:24.593774Z Last Updated: 2024-09-16T18:56:09.537Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS, Prisma Access Problem Types: CWE-78 Description: An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root user privileges. The attacker must have network access to the GlobalProtect interfaces to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier th
network access to the GlobalProtect interfaces to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers with Prisma Access 2.1 Preferred and Prisma Access 2.1 Innovation firewalls are impacted by this issue. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2021-3060 - https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/certificate-management/configure-the-master-key.html