rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-3011 
An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CryptoLib through v2.9. It allows attackers to extract the ECDSA private key after extensive physical access (and consequently produce a clone). This was demonstrated on the Google Titan Security Key, based on an NXP A7005a chip. Other FIDO U2F security keys are also impacted (Yubico YubiKey Neo and Feitian K9, K13, K21, and K40) as well as several NXP JavaCard smartcards (J3A081, J2A081, J3A041, J3D145_M59, J2D145_M59, J3D120_M60, J3D082_M60, J2D120_M60, J2D082_M60, J3D081_M59, J2D081_M59, J3D081_M61, J2D081_M61, J3D081_M59_DF, J3D081_M61_DF, J3E081_M64, J3E081_M66, J2E081_M64, J3E041_M66, J3E016_M66, J3E016_M64, J3E041_M64, J3E145_M64, J3E120_M65, J3E082_M65, J2E145_M64, J2E120_M65, J2E082_M65, J3E081_M64_DF, J3E081_M66_DF, J3E041_M66_DF, J3E016_M66_DF, J3E041_M64_DF, and J3E016_M64_DF).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-07T15:07:18.000Z
CVE-2021-3012 
A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as onerror (in the URL field of the Parameters tab).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-08T10:15:18.000Z
CVE-2021-3013 
ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-11T11:19:37.000Z
CVE-2021-3014 
In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-04T18:38:07.000Z
CVE-2021-3017 
The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspassword line in the HTML source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T17:17:51.000Z
CVE-2021-3018 
ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the /cms/print.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-05T04:37:24.000Z
CVE-2021-3019 
ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-05T04:35:50.000Z
CVE-2021-3020 
An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawk_invoke, allowing escalation to root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T23:32:32.000Z
CVE-2021-3021 
ISPConfig before 3.2.2 allows SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-05T15:47:02.000Z
CVE-2021-3022 
An issue was discovered on LG mobile devices with Android OS 10 software. There was no write protection for the MTK protect2 partition. The LG ID is LVE-SMP-200028 (January 2021).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-05T17:40:48.000Z
CVE-2021-3024 
HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T15:45:23.000Z
CVE-2021-3025 
Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=popular action to the GETindex() method in applications/downloads/api/files.php).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-08T06:21:36.000Z
CVE-2021-3026 
Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-05T22:58:06.000Z
CVE-2021-3027 
app/views_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided search filter because user input gets no sanitization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-26T01:58:15.000Z
CVE-2021-3028 
git-big-picture before 1.0.0 mishandles ' characters in a branch name, leading to code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-13T16:14:20.000Z
CVE-2021-3029 
EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The parameter "file" on the webpage /showfile.php can be exploited to gain root access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-07T13:55:26.000Z
CVE-2021-3031 PAN-OS: Information exposure in Ethernet data frame construction (Etherleak)
Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls are not cleared before the data frame is created. This leaks a small amount of random information from the firewall memory into the Ethernet packets. An attacker on the same Ethernet subnet as the PAN-OS firewall is able to collect potentially sensitive information from these packets. This issue is also known as Etherleak and is detected by security scanners as CVE-2003-0001. This issue impacts: PAN-OS 8.1 version earlier than PAN-OS 8.1.18; PAN-OS 9.0 versions earlier than PAN-OS 9.0.12; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Palo Alto Networks
product: PAN-OS
vendor: Palo Alto Networks
product: PAN-OS
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: This issue was found by a customer of Palo Alto Networks during a security review.
Published: 2021-01-13T18:10:13.174Z
CVE-2021-3032 PAN-OS: Configuration secrets for log forwarding may be logged in system logs
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “snmptrap” v3 log forwarding server profiles can be logged to the logrcvr.log system log. Logged information may include up to 1024 bytes of the configuration including the username and password in an encrypted form and private keys used in any certificate profiles set for log forwarding server profiles. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.18; PAN-OS 9.0 versions earlier than PAN-OS 9.0.12; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: Palo Alto Networks
product: PAN-OS
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: This issue was found by My Tran, Mai Phan, and Claire Zhou of Palo Alto Networks during internal security testing.
Published: 2021-01-13T18:10:13.785Z
CVE-2021-3033 Prisma Cloud Compute: SAML Authentication Bypass Vulnerability in Console
An improper verification of cryptographic signature vulnerability exists in the Palo Alto Networks Prisma Cloud Compute console. This vulnerability enables an attacker to bypass signature validation during SAML authentication by logging in to the Prisma Cloud Compute console as any authorized user. This issue impacts: All versions of Prisma Cloud Compute 19.11, Prisma Cloud Compute 20.04, and Prisma Cloud Compute 20.09; Prisma Cloud Compute 20.12 before update 1. Prisma Cloud Compute SaaS version is not impacted by this vulnerability.
Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: Palo Alto Networks
product: Prisma Cloud Compute
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: This issue was found by Palo Alto Networks during internal security review.
Published: 2021-02-10T17:35:13.982Z
CVE-2021-3034 Cortex XSOAR: Secrets for SAML single sign-on (SSO) integration may be logged in system logs
An information exposure through log file vulnerability exists in Cortex XSOAR software where the secrets configured for the SAML single sign-on (SSO) integration can be logged to the '/var/log/demisto/' server logs when testing the integration during setup. This logged information includes the private key and identity provider certificate used to configure the SAML SSO integration. This issue impacts: Cortex XSOAR 5.5.0 builds earlier than 98622; Cortex XSOAR 6.0.1 builds earlier than 830029; Cortex XSOAR 6.0.2 builds earlier than 98623; Cortex XSOAR 6.1.0 builds earlier than 848144.
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: Palo Alto Networks
product: Cortex XSOAR
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Palo Alto Networks thanks Martin Spielmann and Stefan Lubienetzki for discovering and reporting this issue.
Published: 2021-03-10T18:10:13.665Z
CVE-2021-3035 Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution
An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.26. Checkov 1.0 versions are not impacted.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Palo Alto Networks
product: Bridgecrew Checkov
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Palo Alto Networks thanks Kevin Higgs of Trail of Bits for discovering and reporting this issue.
Published: 2021-04-20T03:15:16.551Z
CVE-2021-3036 PAN-OS: Administrator secrets are logged in web server logs when using the PAN-OS XML API incorrectly
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in cleartext to the web server logs when the API is used incorrectly. This vulnerability applies only to PAN-OS appliances that are configured to use the PAN-OS XML API and exists only when a client includes a duplicate API parameter in API requests. Logged information includes the cleartext username, password, and API key of the administrator making the PAN-OS XML API request.
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: Palo Alto Networks
product: PAN-OS
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Palo Alto Networks thanks David Tien of Cyber Risk for discovering and reporting this issue.
Published: 2021-04-20T03:15:17.198Z
CVE-2021-3037 PAN-OS: Secrets for scheduled configuration exports are logged in system logs
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in system logs. Logged information includes the cleartext username, password, and IP address used to export the PAN-OS configuration to the destination server.
Problem types: cwe_id: CWE-534
description: CWE-534 Information Exposure Through Debug Log Files
Affected products: vendor: Palo Alto Networks
product: PAN-OS
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: This issue was found by a customer of Palo Alto Networks during a security review.
Published: 2021-04-20T03:15:17.834Z
CVE-2021-3038 GlobalProtect App: Windows VPN kernel driver denial of service (DoS)
A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted input to the GlobalProtect app that results in a Windows blue screen of death (BSOD) error. This issue impacts: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.8; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.4.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-248
description: CWE-248 Uncaught Exception
Affected products: vendor: Palo Alto Networks
product: GlobalProtect App
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Palo Alto Networks thanks Christophe Schleypen from NCIA / NCIRC for discovering and reporting this issue.
Published: 2021-04-20T03:15:18.565Z
CVE-2021-3039 Prisma Cloud Compute: User role authorization secret for Console leaked through log file export
An information exposure through log file vulnerability exists in the Palo Alto Networks Prisma Cloud Compute Console where a secret used to authorize the role of the authenticated user is logged to a debug log file. Authenticated Operator role and Auditor role users with access to the debug log files can use this secret to gain Administrator role access for their active session in Prisma Cloud Compute. Prisma Cloud Compute SaaS versions were automatically upgraded to the fixed release. This issue impacts all Prisma Cloud Compute versions earlier than Prisma Cloud Compute 21.04.412.
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: Palo Alto Networks
product: Prisma Cloud Compute
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Palo Alto Networks thanks Jakub Palaczynski for discovering and reporting this issue.
Published: 2021-06-10T12:33:06.234Z
CVE-2021-3040 Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution
An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.139. Checkov 1.0 versions are not impacted.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Palo Alto Networks
product: Bridgecrew Checkov
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Palo Alto Networks thanks Bryan Eastes for discovering and reporting this issue.
Published: 2021-06-10T12:33:06.414Z
CVE-2021-3041 Cortex XDR Agent: Improper control of user-controlled file leads to local privilege escalation
A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory or to manipulate key registry values. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.11; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.8; Cortex XDR agent 7.2 versions earlier than Cortex XDR agent 7.2.3; All versions of Cortex XDR agent 7.2 without content update release 171 or a later version.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: Palo Alto Networks
product: Cortex XDR Agent
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This issue was found by Robert McCallum of Palo Alto Networks during internal security review.
Published: 2021-06-10T12:33:06.552Z
CVE-2021-3042 Cortex XDR Agent: Improper Control of User-Controlled File Leads to Local Privilege Escalation
A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. Exploiting this vulnerability requires the user to have file creation privilege in the Windows root directory (such as C:\). This issue impacts: All versions of Cortex XDR agent 6.1 without content update 181 or a later version; All versions of Cortex XDR agent 7.2 without content update 181 or a later version; All versions of Cortex XDR agent 7.3 without content update 181 or a later version. Cortex XDR agent 5.0 versions are not impacted by this issue. Content updates are required to resolve this issue and are automatically applied for the agent.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: Palo Alto Networks
product: Cortex XDR Agent
vendor: Palo Alto Networks
product: Cortex XDR Agent
vendor: Palo Alto Networks
product: Cortex XDR Agent
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Palo Alto Networks thanks Xavier DANEST of Decathlon for discovering and reporting this issue.
Published: 2021-07-15T16:45:12.285Z
CVE-2021-3043 Prisma Cloud: Cross-Site Scripting (XSS) Vulnerability in Prisma Cloud Compute Web Console
A reflected cross-site scripting (XSS) vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console while an authenticated administrator is using that web interface. Prisma Cloud Compute SaaS versions were automatically upgraded to the fixed release. No additional action is required for these instances. This issue impacts: Prisma Cloud Compute 20.12 versions earlier than Prisma Cloud Compute 20.12.552; Prisma Cloud Compute 21.04 versions earlier than Prisma Cloud Compute 21.04.439.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Palo Alto Networks
product: Prisma Cloud Compute
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This issue was found during an internal security review.
Published: 2021-07-15T16:45:13.845Z
CVE-2021-3044 Cortex XSOAR: Unauthorized Usage of the REST API
An improper authorization vulnerability in Palo Alto Networks Cortex XSOAR enables a remote unauthenticated attacker with network access to the Cortex XSOAR server to perform unauthorized actions through the REST API. This issue impacts: Cortex XSOAR 6.1.0 builds later than 1016923 and earlier than 1271064; Cortex XSOAR 6.2.0 builds earlier than 1271065. This issue does not impact Cortex XSOAR 5.5.0, Cortex XSOAR 6.0.0, Cortex XSOAR 6.0.1, or Cortex XSOAR 6.0.2 versions. All Cortex XSOAR instances hosted by Palo Alto Networks are upgraded to resolve this vulnerability. No additional action is required for these instances.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: Palo Alto Networks
product: Cortex XSOAR
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This issue was found during internal security review.
Published: 2021-06-22T17:15:11.305Z