mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-05-07 19:17:10 +00:00
PANW CVEs assigned September 2021 Patch Wednesday
This commit is contained in:
Chandan
parent
d76258059a
commit
bf7f284329
@ -1,18 +1,137 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@paloaltonetworks.com",
|
||||
"DATE_PUBLIC": "2021-09-08T16:00:00.000Z",
|
||||
"ID": "CVE-2021-3049",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Cortex XSOAR: Improper Authorization of Incident Investigations Vulnerability"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Cortex XSOAR",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "6.1.0",
|
||||
"version_value": "12099345"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_name": "5.5.0",
|
||||
"version_value": "all"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "6.1.0",
|
||||
"version_value": "12099345"
|
||||
},
|
||||
{
|
||||
"version_affected": "!",
|
||||
"version_name": "6.2.0",
|
||||
"version_value": "all"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Palo Alto Networks"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Palo Alto Networks would like to thank CAGIP for discovering and reporting this issue."
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read permissions to download files from incident investigations of which they are aware but are not a part of.\n\nThis issue impacts:\nAll Cortex XSOAR 5.5.0 builds;\nCortex XSOAR 6.1.0 builds earlier than 12099345.\n\nThis issue does not impact Cortex XSOAR 6.2.0 versions."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"exploit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
|
||||
}
|
||||
],
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 2.6,
|
||||
"baseSeverity": "LOW",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-285 Improper Authorization"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2021-3049"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue is fixed in Cortex XSOAR 6.1.0 build 12099345 and all later Cortex XSOAR versions.\n\nThere are currently no Cortex XSOAR 5.5.0 updates available for this issue."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"time": "2021-09-08T16:00:00.000Z",
|
||||
"value": "Initial publication"
|
||||
}
|
||||
],
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "There are no known workarounds for this issue."
|
||||
}
|
||||
],
|
||||
"x_affectedList": [
|
||||
"Cortex XSOAR 6.1.0",
|
||||
"Cortex XSOAR 5.5.0"
|
||||
]
|
||||
}
|
||||
@ -1,18 +1,165 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@paloaltonetworks.com",
|
||||
"DATE_PUBLIC": "2021-09-08T16:00:00.000Z",
|
||||
"ID": "CVE-2021-3051",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Cortex XSOAR: Authentication Bypass in SAML Authentication"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Cortex XSOAR",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "5.5.0",
|
||||
"version_value": "1578677"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "6.0.2",
|
||||
"version_value": "1576452"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "6.1.0",
|
||||
"version_value": "1578663"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "6.2.0",
|
||||
"version_value": "1578666"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "5.5.0",
|
||||
"version_value": "1578677"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "6.0.2",
|
||||
"version_value": "1576452"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "6.1.0",
|
||||
"version_value": "1578663"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "6.2.0",
|
||||
"version_value": "1578666"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Palo Alto Networks"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"configuration": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue is applicable only to Cortex XSOAR configurations with SAML authentication integration enabled.\n\nYou can determine if your configuration has SAML authentication integration enabled by selecting 'Settings > Servers & Services' and searching for 'SAML'."
|
||||
}
|
||||
],
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue was found by a customer of Palo Alto Networks during a security review."
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based attacker with specific knowledge of the Cortex XSOAR instance to access protected resources and perform unauthorized actions on the Cortex XSOAR server.\nThis issue impacts:\nCortex XSOAR 5.5.0 builds earlier than 1578677;\nCortex XSOAR 6.0.2 builds earlier than 1576452;\nCortex XSOAR 6.1.0 builds earlier than 1578663;\nCortex XSOAR 6.2.0 builds earlier than 1578666.\n\nAll Cortex XSOAR instances hosted by Palo Alto Networks are protected from this vulnerability; no additional action is required for these instances.\n"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"exploit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability."
|
||||
}
|
||||
],
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.1,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-347 Improper Verification of Cryptographic Signature"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2021-3051"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue is fixed in Cortex XSOAR 5.5.0 build 1578677, Cortex XSOAR 6.0.2 build 1576452, Cortex XSOAR 6.1.0 build 1578663, Cortex XSOAR 6.2.0 build 1578666, and all later Cortex XSOAR versions."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"time": "2021-09-08T16:00:00.000Z",
|
||||
"value": "Initial publication"
|
||||
}
|
||||
],
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "To completely prevent this issue from being exploited before you can upgrade your Cortex XSOAR server, disable SAML authentication integration.\n\nYou can also restrict network access to the Cortex XSOAR server to allow only trusted users to further reduce the impact of this issue."
|
||||
}
|
||||
],
|
||||
"x_affectedList": [
|
||||
"Cortex XSOAR 6.2.0",
|
||||
"Cortex XSOAR 6.1.0",
|
||||
"Cortex XSOAR 6.0.2",
|
||||
"Cortex XSOAR 5.5.0"
|
||||
]
|
||||
}
|
||||
@ -1,18 +1,310 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@paloaltonetworks.com",
|
||||
"DATE_PUBLIC": "2021-09-08T16:00:00.000Z",
|
||||
"ID": "CVE-2021-3052",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "PAN-OS: Reflected Cross-Site Scripting (XSS) in Web Interface"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "PAN-OS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "9.0",
|
||||
"version_value": "9.0.14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "8.1",
|
||||
"version_value": "8.1.20"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "9.1",
|
||||
"version_value": "9.1.10"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "10.0",
|
||||
"version_value": "10.0.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "9.0",
|
||||
"version_value": "9.0.14"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "8.1",
|
||||
"version_value": "8.1.20"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "9.1",
|
||||
"version_value": "9.1.10"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "10.0",
|
||||
"version_value": "10.0.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "!",
|
||||
"version_name": "10.1",
|
||||
"version_value": "10.1.*"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Palo Alto Networks"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Palo Alto Networks thanks Cristian Mocanu and Dan Marin of Deloitte for discovering and reporting this issue."
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A reflected cross-site scripting (XSS) vulnerability in the Palo Alto Network PAN-OS web interface enables an authenticated network-based attacker to mislead another authenticated PAN-OS administrator to click on a specially crafted link that performs arbitrary actions in the PAN-OS web interface as the targeted authenticated administrator.\nThis issue impacts:\nPAN-OS 8.1 versions earlier than 8.1.20;\nPAN-OS 9.0 versions earlier than 9.0.14;\nPAN-OS 9.1 versions earlier than 9.1.10;\nPAN-OS 10.0 versions earlier than 10.0.2.\n\nThis issue does not affect Prisma Access."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"exploit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability."
|
||||
}
|
||||
],
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79 Cross-site Scripting (XSS)"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2021-3052"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue is fixed in PAN-OS 9.0.14, PAN-OS 8.1.20, PAN-OS 9.1.10, PAN-OS 10.0.2, PAN-OS 10.1.0, and all later PAN-OS versions."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"defect": [
|
||||
"PAN-150337"
|
||||
],
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"time": "2021-09-08T16:00:00.000Z",
|
||||
"value": "Initial publication"
|
||||
}
|
||||
],
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue requires the attacker to have authenticated access to the PAN-OS web interface. You can mitigate the impact of this issue by following best practices for securing the PAN-OS web interface. Please review the Best Practices for Securing Administrative Access in the PAN-OS technical documentation at https://docs.paloaltonetworks.com/best-practices."
|
||||
}
|
||||
],
|
||||
"x_advisoryEoL": false,
|
||||
"x_affectedList": [
|
||||
"PAN-OS 10.0.1",
|
||||
"PAN-OS 10.0.0",
|
||||
"PAN-OS 10.0",
|
||||
"PAN-OS 9.1.9",
|
||||
"PAN-OS 9.1.8",
|
||||
"PAN-OS 9.1.7",
|
||||
"PAN-OS 9.1.6",
|
||||
"PAN-OS 9.1.5",
|
||||
"PAN-OS 9.1.4",
|
||||
"PAN-OS 9.1.3-h1",
|
||||
"PAN-OS 9.1.3",
|
||||
"PAN-OS 9.1.2-h1",
|
||||
"PAN-OS 9.1.2",
|
||||
"PAN-OS 9.1.1",
|
||||
"PAN-OS 9.1.0-h3",
|
||||
"PAN-OS 9.1.0-h2",
|
||||
"PAN-OS 9.1.0-h1",
|
||||
"PAN-OS 9.1.0",
|
||||
"PAN-OS 9.1",
|
||||
"PAN-OS 9.0.13",
|
||||
"PAN-OS 9.0.12",
|
||||
"PAN-OS 9.0.11",
|
||||
"PAN-OS 9.0.10",
|
||||
"PAN-OS 9.0.9-h1",
|
||||
"PAN-OS 9.0.9",
|
||||
"PAN-OS 9.0.8",
|
||||
"PAN-OS 9.0.7",
|
||||
"PAN-OS 9.0.6",
|
||||
"PAN-OS 9.0.5",
|
||||
"PAN-OS 9.0.4",
|
||||
"PAN-OS 9.0.3-h3",
|
||||
"PAN-OS 9.0.3-h2",
|
||||
"PAN-OS 9.0.3-h1",
|
||||
"PAN-OS 9.0.3",
|
||||
"PAN-OS 9.0.2-h4",
|
||||
"PAN-OS 9.0.2-h3",
|
||||
"PAN-OS 9.0.2-h2",
|
||||
"PAN-OS 9.0.2-h1",
|
||||
"PAN-OS 9.0.2",
|
||||
"PAN-OS 9.0.1",
|
||||
"PAN-OS 9.0.0",
|
||||
"PAN-OS 9.0",
|
||||
"PAN-OS 8.1.19",
|
||||
"PAN-OS 8.1.18",
|
||||
"PAN-OS 8.1.17",
|
||||
"PAN-OS 8.1.16",
|
||||
"PAN-OS 8.1.15-h3",
|
||||
"PAN-OS 8.1.15-h2",
|
||||
"PAN-OS 8.1.15-h1",
|
||||
"PAN-OS 8.1.15",
|
||||
"PAN-OS 8.1.14-h2",
|
||||
"PAN-OS 8.1.14-h1",
|
||||
"PAN-OS 8.1.14",
|
||||
"PAN-OS 8.1.13",
|
||||
"PAN-OS 8.1.12",
|
||||
"PAN-OS 8.1.11",
|
||||
"PAN-OS 8.1.10",
|
||||
"PAN-OS 8.1.9-h4",
|
||||
"PAN-OS 8.1.9-h3",
|
||||
"PAN-OS 8.1.9-h2",
|
||||
"PAN-OS 8.1.9-h1",
|
||||
"PAN-OS 8.1.9",
|
||||
"PAN-OS 8.1.8-h5",
|
||||
"PAN-OS 8.1.8-h4",
|
||||
"PAN-OS 8.1.8-h3",
|
||||
"PAN-OS 8.1.8-h2",
|
||||
"PAN-OS 8.1.8-h1",
|
||||
"PAN-OS 8.1.8",
|
||||
"PAN-OS 8.1.7",
|
||||
"PAN-OS 8.1.6-h2",
|
||||
"PAN-OS 8.1.6-h1",
|
||||
"PAN-OS 8.1.6",
|
||||
"PAN-OS 8.1.5",
|
||||
"PAN-OS 8.1.4",
|
||||
"PAN-OS 8.1.3",
|
||||
"PAN-OS 8.1.2",
|
||||
"PAN-OS 8.1.1",
|
||||
"PAN-OS 8.1.0",
|
||||
"PAN-OS 8.1"
|
||||
],
|
||||
"x_likelyAffectedList": [
|
||||
"PAN-OS 8.0.20",
|
||||
"PAN-OS 8.0.19-h1",
|
||||
"PAN-OS 8.0.19",
|
||||
"PAN-OS 8.0.18",
|
||||
"PAN-OS 8.0.17",
|
||||
"PAN-OS 8.0.16",
|
||||
"PAN-OS 8.0.15",
|
||||
"PAN-OS 8.0.14",
|
||||
"PAN-OS 8.0.13",
|
||||
"PAN-OS 8.0.12",
|
||||
"PAN-OS 8.0.11-h1",
|
||||
"PAN-OS 8.0.10",
|
||||
"PAN-OS 8.0.9",
|
||||
"PAN-OS 8.0.8",
|
||||
"PAN-OS 8.0.7",
|
||||
"PAN-OS 8.0.6-h3",
|
||||
"PAN-OS 8.0.6-h2",
|
||||
"PAN-OS 8.0.6-h1",
|
||||
"PAN-OS 8.0.6",
|
||||
"PAN-OS 8.0.5",
|
||||
"PAN-OS 8.0.4",
|
||||
"PAN-OS 8.0.3-h4",
|
||||
"PAN-OS 8.0.3-h3",
|
||||
"PAN-OS 8.0.3-h2",
|
||||
"PAN-OS 8.0.3-h1",
|
||||
"PAN-OS 8.0.3",
|
||||
"PAN-OS 8.0.2",
|
||||
"PAN-OS 8.0.1",
|
||||
"PAN-OS 8.0.0",
|
||||
"PAN-OS 8.0",
|
||||
"PAN-OS 7.1.26",
|
||||
"PAN-OS 7.1.25",
|
||||
"PAN-OS 7.1.24-h1",
|
||||
"PAN-OS 7.1.24",
|
||||
"PAN-OS 7.1.23",
|
||||
"PAN-OS 7.1.22",
|
||||
"PAN-OS 7.1.21",
|
||||
"PAN-OS 7.1.20",
|
||||
"PAN-OS 7.1.19",
|
||||
"PAN-OS 7.1.18",
|
||||
"PAN-OS 7.1.17",
|
||||
"PAN-OS 7.1.16",
|
||||
"PAN-OS 7.1.15",
|
||||
"PAN-OS 7.1.14",
|
||||
"PAN-OS 7.1.13",
|
||||
"PAN-OS 7.1.12",
|
||||
"PAN-OS 7.1.11",
|
||||
"PAN-OS 7.1.10",
|
||||
"PAN-OS 7.1.9-h4",
|
||||
"PAN-OS 7.1.9-h3",
|
||||
"PAN-OS 7.1.9-h2",
|
||||
"PAN-OS 7.1.9-h1",
|
||||
"PAN-OS 7.1.9",
|
||||
"PAN-OS 7.1.8",
|
||||
"PAN-OS 7.1.7",
|
||||
"PAN-OS 7.1.6",
|
||||
"PAN-OS 7.1.5",
|
||||
"PAN-OS 7.1.4-h2",
|
||||
"PAN-OS 7.1.4-h1",
|
||||
"PAN-OS 7.1.4",
|
||||
"PAN-OS 7.1.3",
|
||||
"PAN-OS 7.1.2",
|
||||
"PAN-OS 7.1.1",
|
||||
"PAN-OS 7.1.0",
|
||||
"PAN-OS 7.1"
|
||||
]
|
||||
}
|
||||
@ -1,18 +1,312 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@paloaltonetworks.com",
|
||||
"DATE_PUBLIC": "2021-09-08T16:00:00.000Z",
|
||||
"ID": "CVE-2021-3053",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "PAN-OS: Exceptional Condition Denial-of-Service (DoS)"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "PAN-OS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "8.1",
|
||||
"version_value": "8.1.20"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "9.0",
|
||||
"version_value": "9.0.14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "9.1",
|
||||
"version_value": "9.1.9"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "10.0",
|
||||
"version_value": "10.0.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "8.1",
|
||||
"version_value": "8.1.20"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "9.0",
|
||||
"version_value": "9.0.14"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "9.1",
|
||||
"version_value": "9.1.9"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "10.0",
|
||||
"version_value": "10.0.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "!",
|
||||
"version_name": "10.1",
|
||||
"version_value": "10.1.*"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Palo Alto Networks"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue was found by Nicholas Newsom of Palo Alto Networks during internal security review."
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An improper handling of exceptional conditions vulnerability exists in the Palo Alto Networks PAN-OS dataplane that enables an unauthenticated network-based attacker to send specifically crafted traffic through the firewall that causes the service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode.\nThis issue impacts:\nPAN-OS 8.1 versions earlier than PAN-OS 8.1.20;\nPAN-OS 9.0 versions earlier than PAN-OS 9.0.14;\nPAN-OS 9.1 versions earlier than PAN-OS 9.1.9;\nPAN-OS 10.0 versions earlier than PAN-OS 10.0.5.\n\nThis issue does not affect Prisma Access."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"exploit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
|
||||
}
|
||||
],
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.5,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-755 Improper Handling of Exceptional Conditions"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2021-3053"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue is fixed in PAN-OS 8.1.20, PAN-OS 9.0.14, PAN-OS 9.1.9, PAN-OS 10.0.5, and all later PAN-OS versions."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"defect": [
|
||||
"PAN-158723"
|
||||
],
|
||||
"discovery": "INTERNAL"
|
||||
},
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"time": "2021-09-08T16:00:00.000Z",
|
||||
"value": "Initial publication"
|
||||
}
|
||||
],
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "There are no known workarounds for this issue."
|
||||
}
|
||||
],
|
||||
"x_advisoryEoL": false,
|
||||
"x_affectedList": [
|
||||
"PAN-OS 10.0.4",
|
||||
"PAN-OS 10.0.3",
|
||||
"PAN-OS 10.0.2",
|
||||
"PAN-OS 10.0.1",
|
||||
"PAN-OS 10.0.0",
|
||||
"PAN-OS 10.0",
|
||||
"PAN-OS 9.1.8",
|
||||
"PAN-OS 9.1.7",
|
||||
"PAN-OS 9.1.6",
|
||||
"PAN-OS 9.1.5",
|
||||
"PAN-OS 9.1.4",
|
||||
"PAN-OS 9.1.3-h1",
|
||||
"PAN-OS 9.1.3",
|
||||
"PAN-OS 9.1.2-h1",
|
||||
"PAN-OS 9.1.2",
|
||||
"PAN-OS 9.1.1",
|
||||
"PAN-OS 9.1.0-h3",
|
||||
"PAN-OS 9.1.0-h2",
|
||||
"PAN-OS 9.1.0-h1",
|
||||
"PAN-OS 9.1.0",
|
||||
"PAN-OS 9.1",
|
||||
"PAN-OS 9.0.13",
|
||||
"PAN-OS 9.0.12",
|
||||
"PAN-OS 9.0.11",
|
||||
"PAN-OS 9.0.10",
|
||||
"PAN-OS 9.0.9-h1",
|
||||
"PAN-OS 9.0.9",
|
||||
"PAN-OS 9.0.8",
|
||||
"PAN-OS 9.0.7",
|
||||
"PAN-OS 9.0.6",
|
||||
"PAN-OS 9.0.5",
|
||||
"PAN-OS 9.0.4",
|
||||
"PAN-OS 9.0.3-h3",
|
||||
"PAN-OS 9.0.3-h2",
|
||||
"PAN-OS 9.0.3-h1",
|
||||
"PAN-OS 9.0.3",
|
||||
"PAN-OS 9.0.2-h4",
|
||||
"PAN-OS 9.0.2-h3",
|
||||
"PAN-OS 9.0.2-h2",
|
||||
"PAN-OS 9.0.2-h1",
|
||||
"PAN-OS 9.0.2",
|
||||
"PAN-OS 9.0.1",
|
||||
"PAN-OS 9.0.0",
|
||||
"PAN-OS 9.0",
|
||||
"PAN-OS 8.1.19",
|
||||
"PAN-OS 8.1.18",
|
||||
"PAN-OS 8.1.17",
|
||||
"PAN-OS 8.1.16",
|
||||
"PAN-OS 8.1.15-h3",
|
||||
"PAN-OS 8.1.15-h2",
|
||||
"PAN-OS 8.1.15-h1",
|
||||
"PAN-OS 8.1.15",
|
||||
"PAN-OS 8.1.14-h2",
|
||||
"PAN-OS 8.1.14-h1",
|
||||
"PAN-OS 8.1.14",
|
||||
"PAN-OS 8.1.13",
|
||||
"PAN-OS 8.1.12",
|
||||
"PAN-OS 8.1.11",
|
||||
"PAN-OS 8.1.10",
|
||||
"PAN-OS 8.1.9-h4",
|
||||
"PAN-OS 8.1.9-h3",
|
||||
"PAN-OS 8.1.9-h2",
|
||||
"PAN-OS 8.1.9-h1",
|
||||
"PAN-OS 8.1.9",
|
||||
"PAN-OS 8.1.8-h5",
|
||||
"PAN-OS 8.1.8-h4",
|
||||
"PAN-OS 8.1.8-h3",
|
||||
"PAN-OS 8.1.8-h2",
|
||||
"PAN-OS 8.1.8-h1",
|
||||
"PAN-OS 8.1.8",
|
||||
"PAN-OS 8.1.7",
|
||||
"PAN-OS 8.1.6-h2",
|
||||
"PAN-OS 8.1.6-h1",
|
||||
"PAN-OS 8.1.6",
|
||||
"PAN-OS 8.1.5",
|
||||
"PAN-OS 8.1.4",
|
||||
"PAN-OS 8.1.3",
|
||||
"PAN-OS 8.1.2",
|
||||
"PAN-OS 8.1.1",
|
||||
"PAN-OS 8.1.0",
|
||||
"PAN-OS 8.1"
|
||||
],
|
||||
"x_likelyAffectedList": [
|
||||
"PAN-OS 8.0.20",
|
||||
"PAN-OS 8.0.19-h1",
|
||||
"PAN-OS 8.0.19",
|
||||
"PAN-OS 8.0.18",
|
||||
"PAN-OS 8.0.17",
|
||||
"PAN-OS 8.0.16",
|
||||
"PAN-OS 8.0.15",
|
||||
"PAN-OS 8.0.14",
|
||||
"PAN-OS 8.0.13",
|
||||
"PAN-OS 8.0.12",
|
||||
"PAN-OS 8.0.11-h1",
|
||||
"PAN-OS 8.0.10",
|
||||
"PAN-OS 8.0.9",
|
||||
"PAN-OS 8.0.8",
|
||||
"PAN-OS 8.0.7",
|
||||
"PAN-OS 8.0.6-h3",
|
||||
"PAN-OS 8.0.6-h2",
|
||||
"PAN-OS 8.0.6-h1",
|
||||
"PAN-OS 8.0.6",
|
||||
"PAN-OS 8.0.5",
|
||||
"PAN-OS 8.0.4",
|
||||
"PAN-OS 8.0.3-h4",
|
||||
"PAN-OS 8.0.3-h3",
|
||||
"PAN-OS 8.0.3-h2",
|
||||
"PAN-OS 8.0.3-h1",
|
||||
"PAN-OS 8.0.3",
|
||||
"PAN-OS 8.0.2",
|
||||
"PAN-OS 8.0.1",
|
||||
"PAN-OS 8.0.0",
|
||||
"PAN-OS 8.0",
|
||||
"PAN-OS 7.1.26",
|
||||
"PAN-OS 7.1.25",
|
||||
"PAN-OS 7.1.24-h1",
|
||||
"PAN-OS 7.1.24",
|
||||
"PAN-OS 7.1.23",
|
||||
"PAN-OS 7.1.22",
|
||||
"PAN-OS 7.1.21",
|
||||
"PAN-OS 7.1.20",
|
||||
"PAN-OS 7.1.19",
|
||||
"PAN-OS 7.1.18",
|
||||
"PAN-OS 7.1.17",
|
||||
"PAN-OS 7.1.16",
|
||||
"PAN-OS 7.1.15",
|
||||
"PAN-OS 7.1.14",
|
||||
"PAN-OS 7.1.13",
|
||||
"PAN-OS 7.1.12",
|
||||
"PAN-OS 7.1.11",
|
||||
"PAN-OS 7.1.10",
|
||||
"PAN-OS 7.1.9-h4",
|
||||
"PAN-OS 7.1.9-h3",
|
||||
"PAN-OS 7.1.9-h2",
|
||||
"PAN-OS 7.1.9-h1",
|
||||
"PAN-OS 7.1.9",
|
||||
"PAN-OS 7.1.8",
|
||||
"PAN-OS 7.1.7",
|
||||
"PAN-OS 7.1.6",
|
||||
"PAN-OS 7.1.5",
|
||||
"PAN-OS 7.1.4-h2",
|
||||
"PAN-OS 7.1.4-h1",
|
||||
"PAN-OS 7.1.4",
|
||||
"PAN-OS 7.1.3",
|
||||
"PAN-OS 7.1.2",
|
||||
"PAN-OS 7.1.1",
|
||||
"PAN-OS 7.1.0",
|
||||
"PAN-OS 7.1"
|
||||
]
|
||||
}
|
||||
@ -1,18 +1,323 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@paloaltonetworks.com",
|
||||
"DATE_PUBLIC": "2021-09-08T16:00:00.000Z",
|
||||
"ID": "CVE-2021-3054",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "PAN-OS: Unsigned Code Execution During Plugin Installation Race Condition Vulnerability"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "PAN-OS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "8.1",
|
||||
"version_value": "8.1.20"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "9.0",
|
||||
"version_value": "9.0.14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "10.0",
|
||||
"version_value": "10.0.7"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "9.1",
|
||||
"version_value": "9.1.11"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "10.1",
|
||||
"version_value": "10.1.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "8.1",
|
||||
"version_value": "8.1.20"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "9.0",
|
||||
"version_value": "9.0.14"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "10.0",
|
||||
"version_value": "10.0.7"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "10.1",
|
||||
"version_value": "10.1.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "9.1",
|
||||
"version_value": "9.1.11"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Palo Alto Networks"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Palo Alto Networks thanks Praetorian for discovering and reporting this issue."
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permission to upload plugins to execute arbitrary code with root user privileges.\nThis issue impacts:\nPAN-OS 8.1 versions earlier than PAN-OS 8.1.20;\nPAN-OS 9.0 versions earlier than PAN-OS 9.0.14;\nPAN-OS 9.1 versions earlier than PAN-OS 9.1.11;\nPAN-OS 10.0 versions earlier than PAN-OS 10.0.7;\nPAN-OS 10.1 versions earlier than PAN-OS 10.1.2.\n\nThis issue does not affect Prisma Access."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"exploit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
|
||||
}
|
||||
],
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.2,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2021-3054"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue is fixed in PAN-OS 8.1.20, PAN-OS 9.0.14, PAN-OS 9.1.11, PAN-OS 10.0.7, PAN-OS 10.1.2, and all later PAN-OS versions."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"defect": [
|
||||
"PAN-138727"
|
||||
],
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"time": "2021-09-08T16:00:00.000Z",
|
||||
"value": "Initial publication"
|
||||
}
|
||||
],
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue requires the attacker to have authenticated access to the PAN-OS web interface. You can mitigate the impact of this issue by following best practices for securing the PAN-OS web interface. Please review the Best Practices for Securing Administrative Access in the PAN-OS technical documentation at https://docs.paloaltonetworks.com/best-practices."
|
||||
}
|
||||
],
|
||||
"x_advisoryEoL": false,
|
||||
"x_affectedList": [
|
||||
"PAN-OS 10.1.1",
|
||||
"PAN-OS 10.1.0",
|
||||
"PAN-OS 10.1",
|
||||
"PAN-OS 10.0.6",
|
||||
"PAN-OS 10.0.5",
|
||||
"PAN-OS 10.0.4",
|
||||
"PAN-OS 10.0.3",
|
||||
"PAN-OS 10.0.2",
|
||||
"PAN-OS 10.0.1",
|
||||
"PAN-OS 10.0.0",
|
||||
"PAN-OS 10.0",
|
||||
"PAN-OS 9.1.9",
|
||||
"PAN-OS 9.1.8",
|
||||
"PAN-OS 9.1.7",
|
||||
"PAN-OS 9.1.6",
|
||||
"PAN-OS 9.1.5",
|
||||
"PAN-OS 9.1.4",
|
||||
"PAN-OS 9.1.3-h1",
|
||||
"PAN-OS 9.1.3",
|
||||
"PAN-OS 9.1.2-h1",
|
||||
"PAN-OS 9.1.2",
|
||||
"PAN-OS 9.1.1",
|
||||
"PAN-OS 9.1.0-h3",
|
||||
"PAN-OS 9.1.0-h2",
|
||||
"PAN-OS 9.1.0-h1",
|
||||
"PAN-OS 9.1.0",
|
||||
"PAN-OS 9.1",
|
||||
"PAN-OS 9.0.13",
|
||||
"PAN-OS 9.0.12",
|
||||
"PAN-OS 9.0.11",
|
||||
"PAN-OS 9.0.10",
|
||||
"PAN-OS 9.0.9-h1",
|
||||
"PAN-OS 9.0.9",
|
||||
"PAN-OS 9.0.8",
|
||||
"PAN-OS 9.0.7",
|
||||
"PAN-OS 9.0.6",
|
||||
"PAN-OS 9.0.5",
|
||||
"PAN-OS 9.0.4",
|
||||
"PAN-OS 9.0.3-h3",
|
||||
"PAN-OS 9.0.3-h2",
|
||||
"PAN-OS 9.0.3-h1",
|
||||
"PAN-OS 9.0.3",
|
||||
"PAN-OS 9.0.2-h4",
|
||||
"PAN-OS 9.0.2-h3",
|
||||
"PAN-OS 9.0.2-h2",
|
||||
"PAN-OS 9.0.2-h1",
|
||||
"PAN-OS 9.0.2",
|
||||
"PAN-OS 9.0.1",
|
||||
"PAN-OS 9.0.0",
|
||||
"PAN-OS 9.0",
|
||||
"PAN-OS 8.1.19",
|
||||
"PAN-OS 8.1.18",
|
||||
"PAN-OS 8.1.17",
|
||||
"PAN-OS 8.1.16",
|
||||
"PAN-OS 8.1.15-h3",
|
||||
"PAN-OS 8.1.15-h2",
|
||||
"PAN-OS 8.1.15-h1",
|
||||
"PAN-OS 8.1.15",
|
||||
"PAN-OS 8.1.14-h2",
|
||||
"PAN-OS 8.1.14-h1",
|
||||
"PAN-OS 8.1.14",
|
||||
"PAN-OS 8.1.13",
|
||||
"PAN-OS 8.1.12",
|
||||
"PAN-OS 8.1.11",
|
||||
"PAN-OS 8.1.10",
|
||||
"PAN-OS 8.1.9-h4",
|
||||
"PAN-OS 8.1.9-h3",
|
||||
"PAN-OS 8.1.9-h2",
|
||||
"PAN-OS 8.1.9-h1",
|
||||
"PAN-OS 8.1.9",
|
||||
"PAN-OS 8.1.8-h5",
|
||||
"PAN-OS 8.1.8-h4",
|
||||
"PAN-OS 8.1.8-h3",
|
||||
"PAN-OS 8.1.8-h2",
|
||||
"PAN-OS 8.1.8-h1",
|
||||
"PAN-OS 8.1.8",
|
||||
"PAN-OS 8.1.7",
|
||||
"PAN-OS 8.1.6-h2",
|
||||
"PAN-OS 8.1.6-h1",
|
||||
"PAN-OS 8.1.6",
|
||||
"PAN-OS 8.1.5",
|
||||
"PAN-OS 8.1.4",
|
||||
"PAN-OS 8.1.3",
|
||||
"PAN-OS 8.1.2",
|
||||
"PAN-OS 8.1.1",
|
||||
"PAN-OS 8.1.0",
|
||||
"PAN-OS 8.1"
|
||||
],
|
||||
"x_likelyAffectedList": [
|
||||
"PAN-OS 8.0.20",
|
||||
"PAN-OS 8.0.19-h1",
|
||||
"PAN-OS 8.0.19",
|
||||
"PAN-OS 8.0.18",
|
||||
"PAN-OS 8.0.17",
|
||||
"PAN-OS 8.0.16",
|
||||
"PAN-OS 8.0.15",
|
||||
"PAN-OS 8.0.14",
|
||||
"PAN-OS 8.0.13",
|
||||
"PAN-OS 8.0.12",
|
||||
"PAN-OS 8.0.11-h1",
|
||||
"PAN-OS 8.0.10",
|
||||
"PAN-OS 8.0.9",
|
||||
"PAN-OS 8.0.8",
|
||||
"PAN-OS 8.0.7",
|
||||
"PAN-OS 8.0.6-h3",
|
||||
"PAN-OS 8.0.6-h2",
|
||||
"PAN-OS 8.0.6-h1",
|
||||
"PAN-OS 8.0.6",
|
||||
"PAN-OS 8.0.5",
|
||||
"PAN-OS 8.0.4",
|
||||
"PAN-OS 8.0.3-h4",
|
||||
"PAN-OS 8.0.3-h3",
|
||||
"PAN-OS 8.0.3-h2",
|
||||
"PAN-OS 8.0.3-h1",
|
||||
"PAN-OS 8.0.3",
|
||||
"PAN-OS 8.0.2",
|
||||
"PAN-OS 8.0.1",
|
||||
"PAN-OS 8.0.0",
|
||||
"PAN-OS 8.0",
|
||||
"PAN-OS 7.1.26",
|
||||
"PAN-OS 7.1.25",
|
||||
"PAN-OS 7.1.24-h1",
|
||||
"PAN-OS 7.1.24",
|
||||
"PAN-OS 7.1.23",
|
||||
"PAN-OS 7.1.22",
|
||||
"PAN-OS 7.1.21",
|
||||
"PAN-OS 7.1.20",
|
||||
"PAN-OS 7.1.19",
|
||||
"PAN-OS 7.1.18",
|
||||
"PAN-OS 7.1.17",
|
||||
"PAN-OS 7.1.16",
|
||||
"PAN-OS 7.1.15",
|
||||
"PAN-OS 7.1.14",
|
||||
"PAN-OS 7.1.13",
|
||||
"PAN-OS 7.1.12",
|
||||
"PAN-OS 7.1.11",
|
||||
"PAN-OS 7.1.10",
|
||||
"PAN-OS 7.1.9-h4",
|
||||
"PAN-OS 7.1.9-h3",
|
||||
"PAN-OS 7.1.9-h2",
|
||||
"PAN-OS 7.1.9-h1",
|
||||
"PAN-OS 7.1.9",
|
||||
"PAN-OS 7.1.8",
|
||||
"PAN-OS 7.1.7",
|
||||
"PAN-OS 7.1.6",
|
||||
"PAN-OS 7.1.5",
|
||||
"PAN-OS 7.1.4-h2",
|
||||
"PAN-OS 7.1.4-h1",
|
||||
"PAN-OS 7.1.4",
|
||||
"PAN-OS 7.1.3",
|
||||
"PAN-OS 7.1.2",
|
||||
"PAN-OS 7.1.1",
|
||||
"PAN-OS 7.1.0",
|
||||
"PAN-OS 7.1"
|
||||
]
|
||||
}
|
||||
@ -1,18 +1,314 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@paloaltonetworks.com",
|
||||
"DATE_PUBLIC": "2021-09-08T16:00:00.000Z",
|
||||
"ID": "CVE-2021-3055",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "PAN-OS: XML External Entity (XXE) Reference Vulnerability in the PAN-OS Web Interface"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "PAN-OS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "9.0",
|
||||
"version_value": "9.0.14"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "9.1",
|
||||
"version_value": "9.1.10"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "10.0",
|
||||
"version_value": "10.0.6"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "8.1",
|
||||
"version_value": "8.1.20"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "9.0",
|
||||
"version_value": "9.0.14"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "9.1",
|
||||
"version_value": "9.1.10"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "10.0",
|
||||
"version_value": "10.0.6"
|
||||
},
|
||||
{
|
||||
"version_affected": "!>=",
|
||||
"version_name": "8.1",
|
||||
"version_value": "8.1.20"
|
||||
},
|
||||
{
|
||||
"version_affected": "!",
|
||||
"version_name": "10.1",
|
||||
"version_value": "10.1.*"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Palo Alto Networks"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue was found by a customer of Palo Alto Networks during a security review."
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system and send a specifically crafted request to the firewall that causes the service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode.\nThis issue impacts:\nPAN-OS 8.1 versions earlier than PAN-OS 8.1.20;\nPAN-OS 9.0 versions earlier than PAN-OS 9.0.14;\nPAN-OS 9.1 versions earlier than PAN-OS 9.1.10;\nPAN-OS 10.0 versions earlier than PAN-OS 10.0.6.\nThis issue does not affect Prisma Access."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"exploit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability."
|
||||
}
|
||||
],
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 6.5,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-611 Improper Restriction of XML External Entity Reference ('XXE')"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2021-3055"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue is fixed in PAN-OS 8.1.20, PAN-OS 9.0.14, PAN-OS 9.1.10, PAN-OS 10.0.6, and all later PAN-OS versions."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"defect": [
|
||||
"PAN-166241"
|
||||
],
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"time": "2021-09-08T16:00:00.000Z",
|
||||
"value": "Initial publication"
|
||||
}
|
||||
],
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "This issue requires the attacker to have authenticated access to the PAN-OS web interface. You can mitigate the impact of this issue by following best practices for securing the PAN-OS web interface. Please review the Best Practices for Securing Administrative Access in the PAN-OS technical documentation at https://docs.paloaltonetworks.com/best-practices."
|
||||
}
|
||||
],
|
||||
"x_advisoryEoL": false,
|
||||
"x_affectedList": [
|
||||
"PAN-OS 10.0.5",
|
||||
"PAN-OS 10.0.4",
|
||||
"PAN-OS 10.0.3",
|
||||
"PAN-OS 10.0.2",
|
||||
"PAN-OS 10.0.1",
|
||||
"PAN-OS 10.0.0",
|
||||
"PAN-OS 10.0",
|
||||
"PAN-OS 9.1.9",
|
||||
"PAN-OS 9.1.8",
|
||||
"PAN-OS 9.1.7",
|
||||
"PAN-OS 9.1.6",
|
||||
"PAN-OS 9.1.5",
|
||||
"PAN-OS 9.1.4",
|
||||
"PAN-OS 9.1.3-h1",
|
||||
"PAN-OS 9.1.3",
|
||||
"PAN-OS 9.1.2-h1",
|
||||
"PAN-OS 9.1.2",
|
||||
"PAN-OS 9.1.1",
|
||||
"PAN-OS 9.1.0-h3",
|
||||
"PAN-OS 9.1.0-h2",
|
||||
"PAN-OS 9.1.0-h1",
|
||||
"PAN-OS 9.1.0",
|
||||
"PAN-OS 9.1",
|
||||
"PAN-OS 9.0.13",
|
||||
"PAN-OS 9.0.12",
|
||||
"PAN-OS 9.0.11",
|
||||
"PAN-OS 9.0.10",
|
||||
"PAN-OS 9.0.9-h1",
|
||||
"PAN-OS 9.0.9",
|
||||
"PAN-OS 9.0.8",
|
||||
"PAN-OS 9.0.7",
|
||||
"PAN-OS 9.0.6",
|
||||
"PAN-OS 9.0.5",
|
||||
"PAN-OS 9.0.4",
|
||||
"PAN-OS 9.0.3-h3",
|
||||
"PAN-OS 9.0.3-h2",
|
||||
"PAN-OS 9.0.3-h1",
|
||||
"PAN-OS 9.0.3",
|
||||
"PAN-OS 9.0.2-h4",
|
||||
"PAN-OS 9.0.2-h3",
|
||||
"PAN-OS 9.0.2-h2",
|
||||
"PAN-OS 9.0.2-h1",
|
||||
"PAN-OS 9.0.2",
|
||||
"PAN-OS 9.0.1",
|
||||
"PAN-OS 9.0.0",
|
||||
"PAN-OS 9.0",
|
||||
"PAN-OS 8.1.19",
|
||||
"PAN-OS 8.1.18",
|
||||
"PAN-OS 8.1.17",
|
||||
"PAN-OS 8.1.16",
|
||||
"PAN-OS 8.1.15-h3",
|
||||
"PAN-OS 8.1.15-h2",
|
||||
"PAN-OS 8.1.15-h1",
|
||||
"PAN-OS 8.1.15",
|
||||
"PAN-OS 8.1.14-h2",
|
||||
"PAN-OS 8.1.14-h1",
|
||||
"PAN-OS 8.1.14",
|
||||
"PAN-OS 8.1.13",
|
||||
"PAN-OS 8.1.12",
|
||||
"PAN-OS 8.1.11",
|
||||
"PAN-OS 8.1.10",
|
||||
"PAN-OS 8.1.9-h4",
|
||||
"PAN-OS 8.1.9-h3",
|
||||
"PAN-OS 8.1.9-h2",
|
||||
"PAN-OS 8.1.9-h1",
|
||||
"PAN-OS 8.1.9",
|
||||
"PAN-OS 8.1.8-h5",
|
||||
"PAN-OS 8.1.8-h4",
|
||||
"PAN-OS 8.1.8-h3",
|
||||
"PAN-OS 8.1.8-h2",
|
||||
"PAN-OS 8.1.8-h1",
|
||||
"PAN-OS 8.1.8",
|
||||
"PAN-OS 8.1.7",
|
||||
"PAN-OS 8.1.6-h2",
|
||||
"PAN-OS 8.1.6-h1",
|
||||
"PAN-OS 8.1.6",
|
||||
"PAN-OS 8.1.5",
|
||||
"PAN-OS 8.1.4",
|
||||
"PAN-OS 8.1.3",
|
||||
"PAN-OS 8.1.2",
|
||||
"PAN-OS 8.1.1",
|
||||
"PAN-OS 8.1.0",
|
||||
"PAN-OS 8.1"
|
||||
],
|
||||
"x_likelyAffectedList": [
|
||||
"PAN-OS 8.0.20",
|
||||
"PAN-OS 8.0.19-h1",
|
||||
"PAN-OS 8.0.19",
|
||||
"PAN-OS 8.0.18",
|
||||
"PAN-OS 8.0.17",
|
||||
"PAN-OS 8.0.16",
|
||||
"PAN-OS 8.0.15",
|
||||
"PAN-OS 8.0.14",
|
||||
"PAN-OS 8.0.13",
|
||||
"PAN-OS 8.0.12",
|
||||
"PAN-OS 8.0.11-h1",
|
||||
"PAN-OS 8.0.10",
|
||||
"PAN-OS 8.0.9",
|
||||
"PAN-OS 8.0.8",
|
||||
"PAN-OS 8.0.7",
|
||||
"PAN-OS 8.0.6-h3",
|
||||
"PAN-OS 8.0.6-h2",
|
||||
"PAN-OS 8.0.6-h1",
|
||||
"PAN-OS 8.0.6",
|
||||
"PAN-OS 8.0.5",
|
||||
"PAN-OS 8.0.4",
|
||||
"PAN-OS 8.0.3-h4",
|
||||
"PAN-OS 8.0.3-h3",
|
||||
"PAN-OS 8.0.3-h2",
|
||||
"PAN-OS 8.0.3-h1",
|
||||
"PAN-OS 8.0.3",
|
||||
"PAN-OS 8.0.2",
|
||||
"PAN-OS 8.0.1",
|
||||
"PAN-OS 8.0.0",
|
||||
"PAN-OS 8.0",
|
||||
"PAN-OS 7.1.26",
|
||||
"PAN-OS 7.1.25",
|
||||
"PAN-OS 7.1.24-h1",
|
||||
"PAN-OS 7.1.24",
|
||||
"PAN-OS 7.1.23",
|
||||
"PAN-OS 7.1.22",
|
||||
"PAN-OS 7.1.21",
|
||||
"PAN-OS 7.1.20",
|
||||
"PAN-OS 7.1.19",
|
||||
"PAN-OS 7.1.18",
|
||||
"PAN-OS 7.1.17",
|
||||
"PAN-OS 7.1.16",
|
||||
"PAN-OS 7.1.15",
|
||||
"PAN-OS 7.1.14",
|
||||
"PAN-OS 7.1.13",
|
||||
"PAN-OS 7.1.12",
|
||||
"PAN-OS 7.1.11",
|
||||
"PAN-OS 7.1.10",
|
||||
"PAN-OS 7.1.9-h4",
|
||||
"PAN-OS 7.1.9-h3",
|
||||
"PAN-OS 7.1.9-h2",
|
||||
"PAN-OS 7.1.9-h1",
|
||||
"PAN-OS 7.1.9",
|
||||
"PAN-OS 7.1.8",
|
||||
"PAN-OS 7.1.7",
|
||||
"PAN-OS 7.1.6",
|
||||
"PAN-OS 7.1.5",
|
||||
"PAN-OS 7.1.4-h2",
|
||||
"PAN-OS 7.1.4-h1",
|
||||
"PAN-OS 7.1.4",
|
||||
"PAN-OS 7.1.3",
|
||||
"PAN-OS 7.1.2",
|
||||
"PAN-OS 7.1.1",
|
||||
"PAN-OS 7.1.0",
|
||||
"PAN-OS 7.1"
|
||||
]
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user