8.1

CVE-2021-3051

Cortex XSOAR: Authentication Bypass in SAML Authentication

An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based attacker with specific knowledge of the Cortex XSOAR instance to access protected resources and perform unauthorized actions on the Cortex XSOAR server. This issue impacts: Cortex XSOAR 5.5.0 builds earlier than 1578677; Cortex XSOAR 6.0.2 builds earlier than 1576452; Cortex XSOAR 6.1.0 builds earlier than 1578663; Cortex XSOAR 6.2.0 builds earlier than 1578666. All Cortex XSOAR instances hosted by Palo Alto Networks are protected from this vulnerability; no additional action is required for these instances.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Paloaltonetworks ≫ Cortex Xsoar Version 5.5.0 Update -
Paloaltonetworks ≫ Cortex Xsoar Version 5.5.0 Update 70066
Paloaltonetworks ≫ Cortex Xsoar Version 5.5.0 Update 73387
Paloaltonetworks ≫ Cortex Xsoar Version 5.5.0 Update 75211
Paloaltonetworks ≫ Cortex Xsoar Version 5.5.0 Update 78518
Paloaltonetworks ≫ Cortex Xsoar Version 5.5.0 Update 94592
Paloaltonetworks ≫ Cortex Xsoar Version 6.0.2 Update -
Paloaltonetworks ≫ Cortex Xsoar Version 6.0.2 Update 90947
Paloaltonetworks ≫ Cortex Xsoar Version 6.0.2 Update 93351
Paloaltonetworks ≫ Cortex Xsoar Version 6.0.2 Update 94597
Paloaltonetworks ≫ Cortex Xsoar Version 6.0.2 Update 97682
Paloaltonetworks ≫ Cortex Xsoar Version 6.1.0 Update -
Paloaltonetworks ≫ Cortex Xsoar Version 6.1.0 Update 1016923
Paloaltonetworks ≫ Cortex Xsoar Version 6.1.0 Update 1031903
Paloaltonetworks ≫ Cortex Xsoar Version 6.1.0 Update 1077664
Paloaltonetworks ≫ Cortex Xsoar Version 6.1.0 Update 1209934
Paloaltonetworks ≫ Cortex Xsoar Version 6.1.0 Update 1271079
Paloaltonetworks ≫ Cortex Xsoar Version 6.1.0 Update 848144
Paloaltonetworks ≫ Cortex Xsoar Version 6.2.0 Update -
Paloaltonetworks ≫ Cortex Xsoar Version 6.2.0 Update 1271082
Paloaltonetworks ≫ Cortex Xsoar Version 6.2.0 Update 1321594
Paloaltonetworks ≫ Cortex Xsoar Version 6.2.0 Update 1473927
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.58% 0.435
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
psirt@paloaltonetworks.com 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

https://security.paloaltonetworks.com/CVE-2021-3051
Vendor Advisory