CVE-2021-3058
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permissions to use XML API the ability to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. This issue does not impact Prisma Access firewalls.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Palo Alto Networks | PAN-OS | 10.1 < 10.1.3 | affected |
| Palo Alto Networks | PAN-OS | 9.0 < 9.0.14-h3 | affected |
| Palo Alto Networks | PAN-OS | 8.1 < 8.1.20-h1 | affected |
| Palo Alto Networks | PAN-OS | 9.1 < 9.1.11-h2 | affected |
| Palo Alto Networks | PAN-OS | 10.0 < 10.0.8 | affected |
| Palo Alto Networks | Prisma Access | 2.1 all | unaffected |
| Palo Alto Networks | Prisma Access | 2.2 all | unaffected |
Weaknesses
- CWE-78: CWE-78 OS Command Injection
Workarounds
Enable signatures for Unique Threat ID 91715 on traffic processed by the firewall to block attacks against CVE-2021-3058.
This issue requires the attacker to have authenticated access to the PAN-OS web interface. You can mitigate the impact of this issue by following best practices for securing the PAN-OS web interface. Please review the Best Practices for Securing Administrative Access in the PAN-OS technical documentation at https://docs.paloaltonetworks.com/best-practices.
ADP Enrichment
CVE Program Container
Additional References
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.