Vulnerability · Published Sep 8, 2021 · Assigned by palo_alto
CVE-2021-3051Cortex XSOAR: Authentication Bypass in SAML Authentication
High 8.1
In plain English
A high-severity security flaw in Cortex XSOAR from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Official description
An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based attacker with specific knowledge of the Cortex XSOAR instance to access protected resources and perform unauthorized actions on the Cortex XSOAR server. This issue impacts: Cortex XSOAR 5.5.0 builds earlier than 1578677; Cortex XSOAR 6.0.2 builds earlier than 1576452; Cortex XSOAR 6.1.0 builds earlier than 1578663; Cortex XSOAR 6.2.0 builds earlier than 1578666. All Cortex XSOAR instances hosted by Palo Alto Networks are protected from this vulnerability; no additional action is required for these instances.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Palo Alto Networks | Cortex XSOAR | 5.5.0 – before 15786776.0.2 – before 15764526.1.0 – before 15786636.2.0 – before 1578666 |
Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://security.paloaltonetworks.com/CVE-2021-3051 x_refsource_MISC