CVE-2021-3039: Prisma Cloud Compute: User role authorization secret for Console leaked through log file export
An information exposure through log file vulnerability exists in the Palo Alto Networks Prisma Cloud Compute Console where a secret used to authorize the role of the authenticated user is logged to a debug log file. Authenticated Operator role and Auditor role users with access to the debug log files can use this secret to gain Administrator role access for their active session in Prisma Cloud Compute. Prisma Cloud Compute SaaS versions were automatically upgraded to the fixed release. This issue impacts all Prisma Cloud Compute versions earlier than Prisma Cloud Compute 21.04.412.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Palo Alto Networks Prisma Cloud Compute Consoleto a version that resolves this vulnerability.Fixed in 21.04.412 - Compensating control
Restrict access to Prisma Cloud Compute Console debug log files to prevent authenticated Operator and Auditor role users from exporting debug logs and using the leaked role authorization secret to gain Administrator role access.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3039?
CVE-2021-3039 is classified as an information exposure vulnerability.
How do I fix CVE-2021-3039?
To mitigate CVE-2021-3039, ensure that debug logging is disabled or restrict access to debug log files.
Who is affected by CVE-2021-3039?
CVE-2021-3039 affects authenticated users with Operator or Auditor roles in Palo Alto Networks Prisma Cloud.
What type of data is exposed in CVE-2021-3039?
CVE-2021-3039 exposes a secret used to authorize user roles, logged in a debug log file.
What version of Prisma Cloud is vulnerable to CVE-2021-3039?
CVE-2021-3039 affects versions of Palo Alto Networks Prisma Cloud Compute prior to 21.04.412.