Vulnerability · Published Apr 20, 2021 · Assigned by palo_alto

CVE-2021-3036PAN-OS: Administrator secrets are logged in web server logs when using the PAN-OS XML API incorrectly

Medium 4.4

In plain English

A medium-severity sensitive data in logs in PAN-OS from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)0.2%top 83.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in cleartext to the web server logs when the API is used incorrectly. This vulnerability applies only to PAN-OS appliances that are configured to use the PAN-OS XML API and exists only when a client includes a duplicate API parameter in API requests. Logged information includes the cleartext username, password, and API key of the administrator making the PAN-OS XML API request.

Affected products (as reported)

Vendor	Product	Versions
Palo Alto Networks	PAN-OS	8.1 – before 8.1.199.0 – before 9.0.129.1 – before 9.1.610.0 – before 10.0.1

Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References

https://security.paloaltonetworks.com/CVE-2021-3036 x_refsource_MISC