Lucene search

Palo_altoCVE-2021-3043

HistoryJul 15, 2021 - 5:15 p.m.

CVE-2021-3043

2021-07-1517:15:08

CWE-79

palo_alto

web.nvd.nist.gov

cve-2021-3043

reflected xss

prisma cloud compute

security vulnerability

nvd

information security

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

29.2%

JSON

A reflected cross-site scripting (XSS) vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console while an authenticated administrator is using that web interface. Prisma Cloud Compute SaaS versions were automatically upgraded to the fixed release. No additional action is required for these instances. This issue impacts: Prisma Cloud Compute 20.12 versions earlier than Prisma Cloud Compute 20.12.552; Prisma Cloud Compute 21.04 versions earlier than Prisma Cloud Compute 21.04.439.

Affected configurations

Nvd

Vulners

Node

paloaltonetworksprisma_cloudRange20.12–20.12.552compute

paloaltonetworksprisma_cloudRange21.04–21.04.439compute

VendorProductVersionCPE
paloaltonetworksprisma_cloud*cpe:2.3:a:paloaltonetworks:prisma_cloud:*:*:*:*:compute:*:*:*

Vendor	Product	Version	CPE
paloaltonetworks	prisma_cloud	*	cpe:2.3:a:paloaltonetworks:prisma_cloud:::::compute:::*

CNA Affected

[
  {
    "product": "Prisma Cloud Compute",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "changes": [
          {
            "at": "21.04.439",
            "status": "unaffected"
          }
        ],
        "lessThan": "21.04.439",
        "status": "affected",
        "version": "21.04",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "20.12.552",
            "status": "unaffected"
          }
        ],
        "lessThan": "20.12.552",
        "status": "affected",
        "version": "20.12",
        "versionType": "custom"
      }
    ]
  }
]

References

security.paloaltonetworks.com/CVE-2021-3043

Social References

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

29.2%

JSON

Related for CVE-2021-3043