Vulnerability · Published Sep 8, 2021 · Assigned by palo_alto

CVE-2021-3055PAN-OS: XML External Entity (XXE) Reference Vulnerability in the PAN-OS Web Interface

Medium 6.5

In plain English

A medium-severity XML external entity in PAN-OS from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)1.1%top 34.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system and send a specifically crafted request to the firewall that causes the service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.10; PAN-OS 10.0 versions earlier than PAN-OS 10.0.6. This issue does not affect Prisma Access.

Affected products (as reported)

Vendor	Product	Versions
Palo Alto Networks	PAN-OS	9.0 – before 9.0.149.1 – before 9.1.1010.0 – before 10.0.68.1 – before 8.1.20

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

References

https://security.paloaltonetworks.com/CVE-2021-3055 x_refsource_MISC