Vulnerability · Published Mar 10, 2021 · Assigned by palo_alto

CVE-2021-3034Cortex XSOAR: Secrets for SAML single sign-on (SSO) integration may be logged in system logs

Medium 5.1

In plain English

A medium-severity sensitive data in logs in Cortex XSOAR from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)5.1Medium

Exploit odds (30 days)0.2%top 94.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An information exposure through log file vulnerability exists in Cortex XSOAR software where the secrets configured for the SAML single sign-on (SSO) integration can be logged to the '/var/log/demisto/' server logs when testing the integration during setup. This logged information includes the private key and identity provider certificate used to configure the SAML SSO integration. This issue impacts: Cortex XSOAR 5.5.0 builds earlier than 98622; Cortex XSOAR 6.0.1 builds earlier than 830029; Cortex XSOAR 6.0.2 builds earlier than 98623; Cortex XSOAR 6.1.0 builds earlier than 848144.

Affected products (as reported)

Vendor	Product	Versions
Palo Alto Networks	Cortex XSOAR	5.5.0 – before 986226.0.2 – before 986236.0.1 – before 8300296.1.0 – before 848144

Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

References

https://security.paloaltonetworks.com/CVE-2021-3034 x_refsource_CONFIRM