Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2021-3062
HistoryNov 10, 2021 - 5:15 p.m.

CVE-2021-3062

2021-11-1017:15:10
CWE-284
[email protected]
web.nvd.nist.gov
2
access control
pan-os software
globalprotect portals
ec2 instance
vm-series firewalls
amazon aws
exploitation vulnerability
aws role
prisma access customer

CVSS2

6

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

36.9%

JSON

An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to perform any operations allowed by the EC2 role in AWS. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20 VM-Series firewalls; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11 VM-Series firewalls; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14 VM-Series firewalls; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8 VM-Series firewalls. Prisma Access customers are not impacted by this issue.

Affected configurations

Nvd
Node
paloaltonetworkspan-osRange8.1.0–8.1.20
OR
paloaltonetworkspan-osRange9.0.0–9.0.14
OR
paloaltonetworkspan-osRange9.1.0–9.1.11
OR
paloaltonetworkspan-osRange10.0.0–10.0.8
AND
paloaltonetworksvm-series_firewallMatch-
VendorProductVersionCPE
paloaltonetworkspan-os*cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
paloaltonetworksvm-series_firewall-cpe:2.3:a:paloaltonetworks:vm-series_firewall:-:*:*:*:*:*:*:*

Related

paloalto 1
prion 1
nessus 1
cvelist 1
cve 1
fedora 1
paloalto
paloalto
PAN-OS: Improper Access Control Vulnerability Exposing AWS Instance Metadata Endpoint to GlobalProtect Users
2021-11-10 17:00:00
prion
prion
Improper access control
2021-11-10 17:15:00
nessus
nessus
Palo Alto Networks PAN-OS 8.1.x < 8.1.20 / 9.0.x < 9.0.14 / 9.1.x < 9.1.11 / 10.0.x < 10.0.8 Vulnerability
2021-11-18 00:00:00
cvelist
cvelist
CVE-2021-3062 PAN-OS: Improper Access Control Vulnerability Exposing AWS Instance Metadata Endpoint to GlobalProtect Users
2021-11-10 17:10:27
cve
cve
CVE-2021-3062
2021-11-10 17:15:10
fedora
fedora
[SECURITY] Fedora 35 Update: qt5-qtwebengine-5.15.8-2.fc35
2022-01-30 01:44:13

CVSS2

6

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

36.9%

JSON
Related for NVD:CVE-2021-3062
paloalto1prion1nessus1cvelist1cve1fedora1