Refine your search

5 vulnerabilities found for Prisma Cloud Compute by Palo Alto Networks

CERTFR-2025-AVI-0410
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Palo Alto Networks. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Les versions correctives pour la vulnérabilité CVE-2025-0133 sont prévus pour juin (PAN-OS 11.2.8), juillet (PAN-OS 11.1.11) et août 2025 (PAN-OS 10.2.17)

Impacted products
Vendor Product Description
Palo Alto Networks GlobalProtect App GlobalProtect App versions antérieures à 6.0.0 sans les derniers correctifs de sécurité
Palo Alto Networks PAN-OS PAN-OS versions 11.2.x antérieures à 11.2.5
Palo Alto Networks GlobalProtect App GlobalProtect App versions antérieures à 6.1.0 sans les derniers correctifs de sécurité
Palo Alto Networks N/A MetaDefender Endpoint Security versions antérieures à 4.3.4451 sur Windows
Palo Alto Networks PAN-OS PAN-OS versions antérieures à 10.1.14-h14
Palo Alto Networks PAN-OS PAN-OS versions 10.2.x antérieures à 10.2.13
Palo Alto Networks Prisma Cloud Compute Prisma Cloud Compute Edition versions antérieures à 34.00.141
Palo Alto Networks Prisma Access Prisma Access Browser versions antérieures à 136.11.9.93
Palo Alto Networks PAN-OS PAN-OS versions 11.0.x antérieures à 11.0.7
Palo Alto Networks Cortex XDR Broker Cortex XDR Broker VM versions antérieures à 26.0.119
Palo Alto Networks PAN-OS PAN-OS versions 11.1.x antérieures à 11.1.8
Palo Alto Networks GlobalProtect App GlobalProtect App versions 6.2.x antérieures à 6.2.8 sur macOS
Palo Alto Networks GlobalProtect App GlobalProtect App versions 6.3.x antérieures à 6.3.3 sur macOS
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GlobalProtect App versions ant\u00e9rieures \u00e0 6.0.0 sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "GlobalProtect App",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions 11.2.x ant\u00e9rieures \u00e0 11.2.5",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "GlobalProtect App versions ant\u00e9rieures \u00e0 6.1.0 sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "GlobalProtect App",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "MetaDefender Endpoint Security versions ant\u00e9rieures \u00e0 4.3.4451 sur Windows",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions ant\u00e9rieures \u00e0 10.1.14-h14",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions 10.2.x ant\u00e9rieures \u00e0 10.2.13",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Prisma Cloud Compute Edition versions   ant\u00e9rieures \u00e0 34.00.141",
      "product": {
        "name": "Prisma Cloud Compute",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Prisma Access Browser versions ant\u00e9rieures \u00e0 136.11.9.93",
      "product": {
        "name": "Prisma Access",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions 11.0.x ant\u00e9rieures \u00e0 11.0.7",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Cortex XDR Broker VM versions ant\u00e9rieures \u00e0 26.0.119",
      "product": {
        "name": "Cortex XDR Broker",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions 11.1.x ant\u00e9rieures \u00e0 11.1.8",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "GlobalProtect App versions 6.2.x ant\u00e9rieures \u00e0 6.2.8 sur macOS",
      "product": {
        "name": "GlobalProtect App",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "GlobalProtect App versions 6.3.x ant\u00e9rieures \u00e0 6.3.3 sur macOS",
      "product": {
        "name": "GlobalProtect App",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "Les versions correctives pour la vuln\u00e9rabilit\u00e9 CVE-2025-0133 sont pr\u00e9vus pour juin (PAN-OS 11.2.8),  juillet (PAN-OS 11.1.11) et ao\u00fbt 2025 (PAN-OS 10.2.17)",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-0135",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0135"
    },
    {
      "name": "CVE-2025-3066",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3066"
    },
    {
      "name": "CVE-2025-0134",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0134"
    },
    {
      "name": "CVE-2025-3072",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3072"
    },
    {
      "name": "CVE-2025-0138",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0138"
    },
    {
      "name": "CVE-2025-0131",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0131"
    },
    {
      "name": "CVE-2025-3068",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3068"
    },
    {
      "name": "CVE-2025-3619",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3619"
    },
    {
      "name": "CVE-2025-0137",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0137"
    },
    {
      "name": "CVE-2025-4096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4096"
    },
    {
      "name": "CVE-2025-4052",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4052"
    },
    {
      "name": "CVE-2025-3620",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3620"
    },
    {
      "name": "CVE-2025-0130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0130"
    },
    {
      "name": "CVE-2025-3067",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3067"
    },
    {
      "name": "CVE-2025-0133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0133"
    },
    {
      "name": "CVE-2025-0132",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0132"
    },
    {
      "name": "CVE-2025-4372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4372"
    },
    {
      "name": "CVE-2025-3074",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3074"
    },
    {
      "name": "CVE-2025-4050",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4050"
    },
    {
      "name": "CVE-2025-0136",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0136"
    },
    {
      "name": "CVE-2025-4051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-4051"
    },
    {
      "name": "CVE-2025-3071",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3071"
    },
    {
      "name": "CVE-2025-3069",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3069"
    },
    {
      "name": "CVE-2025-3073",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3073"
    },
    {
      "name": "CVE-2025-3070",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3070"
    }
  ],
  "initial_release_date": "2025-05-15T00:00:00",
  "last_revision_date": "2025-05-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0410",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-05-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Palo Alto Networks. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Palo Alto Networks",
  "vendor_advisories": [
    {
      "published_at": "2025-05-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2025-0138",
      "url": "https://security.paloaltonetworks.com/CVE-2025-0138"
    },
    {
      "published_at": "2025-05-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2025-0133",
      "url": "https://security.paloaltonetworks.com/CVE-2025-0133"
    },
    {
      "published_at": "2025-05-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2025-0134",
      "url": "https://security.paloaltonetworks.com/CVE-2025-0134"
    },
    {
      "published_at": "2025-05-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2025-0131",
      "url": "https://security.paloaltonetworks.com/CVE-2025-0131"
    },
    {
      "published_at": "2025-06-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2025-0135",
      "url": "https://security.paloaltonetworks.com/CVE-2025-0135"
    },
    {
      "published_at": "2025-05-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2025-0137",
      "url": "https://security.paloaltonetworks.com/CVE-2025-0137"
    },
    {
      "published_at": "2025-05-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2025-0132",
      "url": "https://security.paloaltonetworks.com/CVE-2025-0132"
    },
    {
      "published_at": "2025-05-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks PAN-SA-2025-0009",
      "url": "https://security.paloaltonetworks.com/PAN-SA-2025-0009"
    },
    {
      "published_at": "2025-05-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2025-0136",
      "url": "https://security.paloaltonetworks.com/CVE-2025-0136"
    },
    {
      "published_at": "2025-05-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2025-0130",
      "url": "https://security.paloaltonetworks.com/CVE-2025-0130"
    }
  ]
}

CERTFR-2024-AVI-0491
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Palo Alto Networks. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Palo Alto Networks GlobalProtect App GlobalProtect App versions 6.2.x antérieures à 6.2.3
Palo Alto Networks GlobalProtect App GlobalProtect App versions 5.1.x antérieures à 5.1.12
Palo Alto Networks Cortex XDR Agent Cortex XDR Agent versions 7.9.x.-CE antérieures à 7.9.102-CE sur Windows
Palo Alto Networks Cortex XDR Agent Cortex XDR Agent versions 8.1.x à 8.2.x antérieures à 8.2.1 sur Windows
Palo Alto Networks GlobalProtect App GlobalProtect App versions 6.1.x antérieures à 6.1.3
Palo Alto Networks GlobalProtect App GlobalProtect App versions 6.0.x antérieures à 6.0.8
Palo Alto Networks Cortex XDR Agent Cortex XDR Agent versions 8.3.x antérieures à 8.3.1 sur Windows
Palo Alto Networks Prisma Cloud Compute Prisma Cloud Compute versions 32.x antérieures à 32.05 (O’Neal - Update 5)
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "GlobalProtect App versions 6.2.x ant\u00e9rieures \u00e0 6.2.3",
      "product": {
        "name": "GlobalProtect App",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "GlobalProtect App versions 5.1.x ant\u00e9rieures \u00e0 5.1.12",
      "product": {
        "name": "GlobalProtect App",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Cortex XDR Agent versions 7.9.x.-CE ant\u00e9rieures \u00e0 7.9.102-CE sur Windows",
      "product": {
        "name": "Cortex XDR Agent",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Cortex XDR Agent versions 8.1.x \u00e0 8.2.x ant\u00e9rieures \u00e0 8.2.1 sur Windows",
      "product": {
        "name": "Cortex XDR Agent",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "GlobalProtect App versions 6.1.x ant\u00e9rieures \u00e0 6.1.3",
      "product": {
        "name": "GlobalProtect App",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "GlobalProtect App versions 6.0.x ant\u00e9rieures \u00e0 6.0.8",
      "product": {
        "name": "GlobalProtect App",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Cortex XDR Agent versions 8.3.x ant\u00e9rieures \u00e0 8.3.1 sur Windows",
      "product": {
        "name": "Cortex XDR Agent",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Prisma Cloud Compute versions 32.x ant\u00e9rieures \u00e0 32.05 (O\u2019Neal - Update 5)",
      "product": {
        "name": "Prisma Cloud Compute",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-5908",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-5908"
    },
    {
      "name": "CVE-2024-5907",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-5907"
    },
    {
      "name": "CVE-2024-5905",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-5905"
    },
    {
      "name": "CVE-2024-5906",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-5906"
    },
    {
      "name": "CVE-2024-5909",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-5909"
    }
  ],
  "initial_release_date": "2024-06-13T00:00:00",
  "last_revision_date": "2024-06-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0491",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-06-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Palo Alto Networks. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Palo Alto Networks",
  "vendor_advisories": [
    {
      "published_at": "2024-06-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2024-5906",
      "url": "https://security.paloaltonetworks.com/CVE-2024-5906"
    },
    {
      "published_at": "2024-06-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2024-5908",
      "url": "https://security.paloaltonetworks.com/CVE-2024-5908"
    },
    {
      "published_at": "2024-06-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2024-5907",
      "url": "https://security.paloaltonetworks.com/CVE-2024-5907"
    },
    {
      "published_at": "2024-06-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2024-5905",
      "url": "https://security.paloaltonetworks.com/CVE-2024-5905"
    },
    {
      "published_at": "2024-06-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2024-5909",
      "url": "https://security.paloaltonetworks.com/CVE-2024-5909"
    }
  ]
}

CERTFR-2021-AVI-532
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Palo Alto Networks. Elles permettent à un attaquant de provoquer une élévation de privilèges et une injection de code indirecte à distance (XSS).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
Palo Alto Networks Prisma Cloud Compute Prisma Cloud Compute versions 20.12 antérieures à 20.12.552
Palo Alto Networks Prisma Cloud Compute Prisma Cloud Compute versions 21.04 antérieures à 21.04.439
Palo Alto Networks Cortex XDR Agent Cortex XDR Agent versions 7.3 sans le correctif 181
Palo Alto Networks Cortex XDR Agent Cortex XDR Agent versions 7.2 sans le correctif 181
Palo Alto Networks Cortex XDR Agent Cortex XDR Agent versions 6.1 sans le correctif 181
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Prisma Cloud Compute versions 20.12 ant\u00e9rieures \u00e0 20.12.552",
      "product": {
        "name": "Prisma Cloud Compute",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Prisma Cloud Compute versions 21.04 ant\u00e9rieures \u00e0 21.04.439",
      "product": {
        "name": "Prisma Cloud Compute",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Cortex XDR Agent versions 7.3 sans le correctif 181",
      "product": {
        "name": "Cortex XDR Agent",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Cortex XDR Agent versions 7.2 sans le correctif 181",
      "product": {
        "name": "Cortex XDR Agent",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Cortex XDR Agent versions 6.1 sans le correctif 181",
      "product": {
        "name": "Cortex XDR Agent",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-3042",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3042"
    },
    {
      "name": "CVE-2021-3043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3043"
    }
  ],
  "initial_release_date": "2021-07-16T00:00:00",
  "last_revision_date": "2021-07-16T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto\u00a0Networks CVE-2021-3042 du 14 juillet 2021",
      "url": "https://security.paloaltonetworks.com/CVE-2021-3042"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto\u00a0Networks CVE-2021-3043 du 14 juillet 2021",
      "url": "https://security.paloaltonetworks.com/CVE-2021-3043"
    }
  ],
  "reference": "CERTFR-2021-AVI-532",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-07-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Palo\nAlto Networks. Elles permettent \u00e0 un attaquant de provoquer une\n\u00e9l\u00e9vation de privil\u00e8ges et une injection de code indirecte \u00e0 distance\n(XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Palo Alto Networks",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2021-3043 du 14 juillet 2021",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2021-3042 du 14 juillet 2021",
      "url": null
    }
  ]
}

CERTFR-2021-AVI-454
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Palo Alto Networks. Elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à la confidentialité des données et une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
Palo Alto Networks Cortex XDR Agent Cortex XDR Agent versions 7.2.x antérieures à 7.2.3 ou sans un correctif de sécurité antérieur à 171
Palo Alto Networks Cortex XDR Agent Cortex XDR Agent versions 6.1.x antérieures à 6.1.8
Palo Alto Networks Prisma Cloud Compute Prisma Cloud Compute versions antérieures à 21.04.412
Palo Alto Networks Cortex XDR Agent Cortex XDR Agent versions 5.0.x antérieures à 5.0.11
Palo Alto Networks N/A Bridgecrew Checkov versions 2.x antérieures à 2.0.139
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cortex XDR Agent versions 7.2.x ant\u00e9rieures \u00e0 7.2.3 ou sans un correctif de s\u00e9curit\u00e9 ant\u00e9rieur \u00e0 171",
      "product": {
        "name": "Cortex XDR Agent",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Cortex XDR Agent versions 6.1.x ant\u00e9rieures \u00e0 6.1.8",
      "product": {
        "name": "Cortex XDR Agent",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Prisma Cloud Compute versions ant\u00e9rieures \u00e0 21.04.412",
      "product": {
        "name": "Prisma Cloud Compute",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Cortex XDR Agent versions 5.0.x ant\u00e9rieures \u00e0 5.0.11",
      "product": {
        "name": "Cortex XDR Agent",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Bridgecrew Checkov versions 2.x ant\u00e9rieures \u00e0 2.0.139",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-3041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3041"
    },
    {
      "name": "CVE-2021-3040",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3040"
    },
    {
      "name": "CVE-2021-3039",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3039"
    }
  ],
  "initial_release_date": "2021-06-10T00:00:00",
  "last_revision_date": "2021-06-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-454",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-06-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Palo\nAlto Networks. Elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire, une atteinte \u00e0 la confidentialit\u00e9 des\ndonn\u00e9es et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Palo Alto Networks",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2021-3040 du 09 juin 2021",
      "url": "https://security.paloaltonetworks.com/CVE-2021-3040"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2021-3041 du 09 juin 2021",
      "url": "https://security.paloaltonetworks.com/CVE-2021-3041"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2021-3039 du 09 juin 2021",
      "url": "https://security.paloaltonetworks.com/CVE-2021-3039"
    }
  ]
}

CERTFR-2021-AVI-110
Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans Palo Alto Networks Prisma Cloud Compute. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
Palo Alto Networks Prisma Cloud Compute Prisma Cloud Compute versions antérieures à 20.12 update 1
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Prisma Cloud Compute versions ant\u00e9rieures \u00e0 20.12 update 1",
      "product": {
        "name": "Prisma Cloud Compute",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-3033",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3033"
    }
  ],
  "initial_release_date": "2021-02-11T00:00:00",
  "last_revision_date": "2021-02-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-110",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-02-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Palo Alto Networks Prisma Cloud\nCompute. Elle permet \u00e0 un attaquant de provoquer un contournement de la\npolitique de s\u00e9curit\u00e9, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Palo Alto Networks Prisma Cloud Compute",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2021-3033 du 10 f\u00e9vrier 2021",
      "url": "https://security.paloaltonetworks.com/CVE-2021-3033"
    }
  ]
}