CVE-2021-3051 Cortex XSOAR: Authentication Bypass in SAML Authentication
An attacker can bypass SAML authentication to access protected resources and perform unauthorized actions on the Cortex XSOAR server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-3051?
CVE-2021-3051 is a high-severity authentication bypass vulnerability in Palo Alto Networks Cortex XSOAR, published on 8 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based attacker with specific knowledge of the Cortex XSOAR instance to access protected resources and perform unauthorized actions on the Cortex XSOAR server. This issue impacts: Cortex XSOAR 5.5.0 builds earlier than 1578677; Cortex XSOAR 6.0.2 builds earlier than 1576452; Cortex XSOAR 6.1.0 builds earlier than 1578663; Cortex XSOAR 6.2.0 builds earlier than 1578666. All Cortex XSOAR instances hosted by Palo Alto Networks are protected from this vulnerability; no additional action is required for these instances.
Weakness: CWE-347
Which versions are affected by CVE-2021-3051?
It affects 1 product.
Products include Paloaltonetworks Cortex Xsoar.
How do I fix CVE-2021-3051?
No fix has been published for CVE-2021-3051 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-3051 being exploited?
There is no known exploitation of CVE-2021-3051 in the wild and no public exploit code.
Other vulnerabilities in Palo Alto Networks Cortex XSOAR
- CVE-2021-3044 Cortex XSOAR: Unauthorized Usage of the REST API
- CVE-2022-0020 Cortex XSOAR: Stored Cross-Site Scripting (XSS) Vulnerability in Web Interface
- CVE-2022-0031 Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine
- CVE-2023-3282 Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine
- CVE-2021-3034 Cortex XSOAR: Secrets for SAML single sign-on (SSO) integration may be logged in system logs
Sources
Also known as GHSA-4qfq-vjf3-59qg.