CVE-2021-3055: PAN-OS: XML External Entity (XXE) Reference Vulnerability in the PAN-OS Web Interface
An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system and send a specifically crafted request to the firewall that causes the service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.10; PAN-OS 10.0 versions earlier than PAN-OS 10.0.6. This issue does not affect Prisma Access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 8.1.20 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 9.0.14 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 9.1.10 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 10.0.6
Event History
Frequently Asked Questions
What is CVE-2021-3055?
CVE-2021-3055 is an improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface.
How does CVE-2021-3055 impact Palo Alto Networks PAN-OS?
CVE-2021-3055 allows an authenticated administrator to read any arbitrary file from the file system and crash the service by sending a specifically crafted request to the firewall.
Which versions of Palo Alto Networks PAN-OS are affected by CVE-2021-3055?
Palo Alto Networks PAN-OS versions 8.1.0 to 8.1.20, 9.0.0 to 9.0.14, 9.1.0 to 9.1.10, and 10.0.0 to 10.0.6 are affected by CVE-2021-3055.
What is the severity of CVE-2021-3055?
CVE-2021-3055 has a severity rating of 6.5, which is considered high.
How can the CVE-2021-3055 vulnerability be fixed?
To fix the CVE-2021-3055 vulnerability, Palo Alto Networks users should upgrade to a version that is not affected by the vulnerability. Please refer to the official Palo Alto Networks security advisory for specific version details.