Lucene search

[email protected]CVE-2021-3058

HistoryNov 10, 2021 - 5:15 p.m.

CVE-2021-3058

2021-11-1017:15:00

CWE-78

[email protected]

web.nvd.nist.gov

cve-2021-3058

palo alto networks

pan-os

command injection

vulnerability

os commands

xml api

privilege escalation

nvd

security advisory

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

47.5%

JSON

An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permissions to use XML API the ability to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. This issue does not impact Prisma Access firewalls.

CPENameOperatorVersion
paloaltonetworks:pan-ospaloaltonetworks pan-oslt10.0.8
paloaltonetworks:pan-ospaloaltonetworks pan-oslt10.1.3
paloaltonetworks:pan-ospaloaltonetworks pan-osle8.1.20
paloaltonetworks:pan-ospaloaltonetworks pan-osle9.0.14
paloaltonetworks:pan-ospaloaltonetworks pan-osle9.1.11

CPE	Name	Operator	Version
paloaltonetworks:pan-os	paloaltonetworks pan-os	lt	10.0.8
paloaltonetworks:pan-os	paloaltonetworks pan-os	lt	10.1.3
paloaltonetworks:pan-os	paloaltonetworks pan-os	le	8.1.20
paloaltonetworks:pan-os	paloaltonetworks pan-os	le	9.0.14
paloaltonetworks:pan-os	paloaltonetworks pan-os	le	9.1.11

References

security.paloaltonetworks.com/CVE-2021-3058

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

47.5%

JSON

Related for CVE-2021-3058

paloalto1 cvelist1 prion1 nessus1 cnvd1