CVE-2021-3055 — XML External Entity (XXE) Injection in Palo Alto Networks Pan-os

CWE-611 — XML External Entity (XXE) Injection4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.3%
top 48.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Palo Alto Networks Pan-osPaloaltonetworks Pan-osPaloalto Pan-os
Timeline
PublishedSep 8
Latest updateMay 24

Description

An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system and send a specifically crafted request to the firewall that causes the service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlie…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:HExploitability: 1.2 | Impact: 5.2

Affected Packages3 packages

▶NVDpaloaltonetworks/pan-os8.1.0 — 8.1.20+3
▶CVEListV5palo_alto_networks/pan-os9.0 — 9.0.14+3
▶Palo Altopaloalto/pan-os

🔴Vulnerability Details

2
GHSA
GHSA-q695-424c-rgvg: An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated a↗2022-05-24
▶
CVEList
PAN-OS: XML External Entity (XXE) Reference Vulnerability in the PAN-OS Web Interface↗2021-09-08
▶

📋Vendor Advisories

1
Palo Alto
PAN-OS: XML External Entity (XXE) Reference Vulnerability in the PAN-OS Web Interface↗2021-09-08
▶
CVE-2021-3055 — XML External Entity (XXE) Injection | cvebase