Lucene search

[email protected]CVE-2021-3047

HistoryAug 11, 2021 - 5:15 p.m.

CVE-2021-3047

2021-08-1117:15:07

CWE-338

[email protected]

web.nvd.nist.gov

cve-2021-3047

palo alto networks

pan-os

web interface

authentication

prng

session impersonation

vulnerability

nvd

4.2 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

22.6%

JSON

A cryptographically weak pseudo-random number generator (PRNG) is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an authenticated attacker, with the capability to observe their own authentication secrets over a long duration on the PAN-OS appliance, to impersonate another authenticated web interface administrator’s session. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.19; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.10; PAN-OS 10.0 versions earlier than PAN-OS 10.0.4. PAN-OS 10.1 versions are not impacted.

Affected configurations

NVD

Node

paloaltonetworkspan-osRange8.1.0–8.1.19

paloaltonetworkspan-osRange9.0.0–9.0.14

paloaltonetworkspan-osRange9.1.0–9.1.10

paloaltonetworkspan-osRange10.0.0–10.0.4

CPENameOperatorVersion
paloaltonetworks:pan-ospaloaltonetworks pan-oslt8.1.19
paloaltonetworks:pan-ospaloaltonetworks pan-oslt9.0.14
paloaltonetworks:pan-ospaloaltonetworks pan-oslt9.1.10
paloaltonetworks:pan-ospaloaltonetworks pan-oslt10.0.4

CPE	Name	Operator	Version
paloaltonetworks:pan-os	paloaltonetworks pan-os	lt	8.1.19
paloaltonetworks:pan-os	paloaltonetworks pan-os	lt	9.0.14
paloaltonetworks:pan-os	paloaltonetworks pan-os	lt	9.1.10
paloaltonetworks:pan-os	paloaltonetworks pan-os	lt	10.0.4

CNA Affected

[
  {
    "product": "PAN-OS",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "unaffected",
        "version": "10.1.*"
      },
      {
        "changes": [
          {
            "at": "8.1.19",
            "status": "unaffected"
          }
        ],
        "lessThan": "8.1.19",
        "status": "affected",
        "version": "8.1",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "9.0.14",
            "status": "unaffected"
          }
        ],
        "lessThan": "9.0.14",
        "status": "affected",
        "version": "9.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "10.0.4",
            "status": "unaffected"
          }
        ],
        "lessThan": "10.0.4",
        "status": "affected",
        "version": "10.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "9.1.10",
            "status": "unaffected"
          }
        ],
        "lessThan": "9.1.10",
        "status": "affected",
        "version": "9.1",
        "versionType": "custom"
      }
    ]
  }
]

References

security.paloaltonetworks.com/CVE-2021-3047

Social References

4.2 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

22.6%

JSON

Related for CVE-2021-3047

nessus1 prion1 nvd1 paloalto1 cvelist1