CVE-2021-3055 PAN-OS: XML External Entity (XXE) Reference Vulnerability in the PAN-OS Web Interface

Medium 6.5 Published 8 Sep 2021 Updated 17 Sep 2024

An authenticated administrator can exploit an XXE vulnerability in the PAN-OS web interface to read arbitrary files and cause a denial of service.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-3055?

CVE-2021-3055 is a medium-severity vulnerability in Paloaltonetworks Pan-Os, published on 8 Sep 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system and send a specifically crafted request to the firewall that causes the service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.10; PAN-OS 10.0 versions earlier than PAN-OS 10.0.6. This issue does not affect Prisma Access.

Weakness: CWE-611

Which versions are affected by CVE-2021-3055?

It affects 1 product.

Products include Paloaltonetworks Pan-Os.

How do I fix CVE-2021-3055?

No fix has been published for CVE-2021-3055 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-3055 being exploited?

There is no known exploitation of CVE-2021-3055 in the wild and no public exploit code.

All Paloaltonetworks Pan-Os vulnerabilities

Sources

Also known as GHSA-q695-424c-rgvg.