How does CVE-2021-3055 impact Palo Alto Networks PAN-OS?

CVE-2021-3055 allows an authenticated administrator to read any arbitrary file from the file system and crash the service by sending a specifically crafted request to the firewall.

Which versions of Palo Alto Networks PAN-OS are affected by CVE-2021-3055?

Palo Alto Networks PAN-OS versions 8.1.0 to 8.1.20, 9.0.0 to 9.0.14, 9.1.0 to 9.1.10, and 10.0.0 to 10.0.6 are affected by CVE-2021-3055.

What is the severity of CVE-2021-3055?

CVE-2021-3055 has a severity rating of 6.5, which is considered high.

How can the CVE-2021-3055 vulnerability be fixed?

To fix the CVE-2021-3055 vulnerability, Palo Alto Networks users should upgrade to a version that is not affected by the vulnerability. Please refer to the official Palo Alto Networks security advisory for specific version details.

Vulnerability/
CVE-2021-3055

high

7.5

CWE

611

8/9/2021

15/9/2021

CVE-2021-3055: XEE

Q: What is CVE-2021-3055?

CVE-2021-3055 is an improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface.

First published: Wed Sep 08 2021(Updated: )

An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system and send a specifically crafted request to the firewall that causes the service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.10; PAN-OS 10.0 versions earlier than PAN-OS 10.0.6. This issue does not affect Prisma Access.

Credit: psirt@paloaltonetworks.com

Affected Software	Affected Version	How to fix
Paloaltonetworks Pan-os	>=8.1.0<8.1.20
Paloaltonetworks Pan-os	>=9.0.0<9.0.14
Paloaltonetworks Pan-os	>=9.1.0<9.1.10
Paloaltonetworks Pan-os	>=10.0.0<10.0.6

Never miss a vulnerability like this again

Reference Links

https://security.paloaltonetworks.com/CVE-2021-3055

Frequently Asked Questions

What is CVE-2021-3055?
CVE-2021-3055 is an improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface.
How does CVE-2021-3055 impact Palo Alto Networks PAN-OS?
CVE-2021-3055 allows an authenticated administrator to read any arbitrary file from the file system and crash the service by sending a specifically crafted request to the firewall.
Which versions of Palo Alto Networks PAN-OS are affected by CVE-2021-3055?
Palo Alto Networks PAN-OS versions 8.1.0 to 8.1.20, 9.0.0 to 9.0.14, 9.1.0 to 9.1.10, and 10.0.0 to 10.0.6 are affected by CVE-2021-3055.
What is the severity of CVE-2021-3055?
CVE-2021-3055 has a severity rating of 6.5, which is considered high.
How can the CVE-2021-3055 vulnerability be fixed?
To fix the CVE-2021-3055 vulnerability, Palo Alto Networks users should upgrade to a version that is not affected by the vulnerability. Please refer to the official Palo Alto Networks security advisory for specific version details.

collector/nvd-index
agent/weakness
agent/tags
agent/severity
agent/author
agent/references
agent/description
agent/type
agent/event
agent/last-modified-date
agent/softwarecombine
agent/first-publish-date
vendor/paloaltonetworks
canonical/paloaltonetworks pan-os
version/paloaltonetworks pan-os/8.1.0
version/paloaltonetworks pan-os/9.0.0
version/paloaltonetworks pan-os/9.1.0
version/paloaltonetworks pan-os/10.0.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.