Vulnerability-Lookup

FKIE_CVE-2021-3051

Vulnerability from fkie_nvd - Published: 2021-09-08 17:15 - Updated: 2026-06-17 04:04

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based attacker with specific knowledge of the Cortex XSOAR instance to access protected resources and perform unauthorized actions on the Cortex XSOAR server. This issue impacts: Cortex XSOAR 5.5.0 builds earlier than 1578677; Cortex XSOAR 6.0.2 builds earlier than 1576452; Cortex XSOAR 6.1.0 builds earlier than 1578663; Cortex XSOAR 6.2.0 builds earlier than 1578666. All Cortex XSOAR instances hosted by Palo Alto Networks are protected from this vulnerability; no additional action is required for these instances.

References

	URL	Tags
	psirt@paloaltonetworks.com	https://security.paloaltonetworks.com/CVE-2021-3051	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://security.paloaltonetworks.com/CVE-2021-3051	Vendor Advisory

Impacted products

Vendor	Product	Version
paloaltonetworks	cortex_xsoar	5.5.0
paloaltonetworks	cortex_xsoar	5.5.0
paloaltonetworks	cortex_xsoar	5.5.0
paloaltonetworks	cortex_xsoar	5.5.0
paloaltonetworks	cortex_xsoar	5.5.0
paloaltonetworks	cortex_xsoar	5.5.0
paloaltonetworks	cortex_xsoar	6.0.2
paloaltonetworks	cortex_xsoar	6.0.2
paloaltonetworks	cortex_xsoar	6.0.2
paloaltonetworks	cortex_xsoar	6.0.2
paloaltonetworks	cortex_xsoar	6.0.2
paloaltonetworks	cortex_xsoar	6.1.0
paloaltonetworks	cortex_xsoar	6.1.0
paloaltonetworks	cortex_xsoar	6.1.0
paloaltonetworks	cortex_xsoar	6.1.0
paloaltonetworks	cortex_xsoar	6.1.0
paloaltonetworks	cortex_xsoar	6.1.0
paloaltonetworks	cortex_xsoar	6.1.0
paloaltonetworks	cortex_xsoar	6.2.0
paloaltonetworks	cortex_xsoar	6.2.0
paloaltonetworks	cortex_xsoar	6.2.0
paloaltonetworks	cortex_xsoar	6.2.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Cortex XSOAR",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "1578677",
                  "status": "unaffected"
                }
              ],
              "lessThan": "1578677",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "1576452",
                  "status": "unaffected"
                }
              ],
              "lessThan": "1576452",
              "status": "affected",
              "version": "6.0.2",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "1578663",
                  "status": "unaffected"
                }
              ],
              "lessThan": "1578663",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "1578666",
                  "status": "unaffected"
                }
              ],
              "lessThan": "1578666",
              "status": "affected",
              "version": "6.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "psirt@paloaltonetworks.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:5.5.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "0513C590-B393-45B9-BD95-14F09A33A6FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:5.5.0:70066:*:*:*:*:*:*",
              "matchCriteriaId": "CCC73F19-BAEC-464E-813E-AABFB0FF1749",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:5.5.0:73387:*:*:*:*:*:*",
              "matchCriteriaId": "829FDD7F-9F92-4425-BA03-7A916C672A1A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:5.5.0:75211:*:*:*:*:*:*",
              "matchCriteriaId": "01F6E4B3-7264-4B6B-A2E0-EC0C6E454FE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:5.5.0:78518:*:*:*:*:*:*",
              "matchCriteriaId": "BFF634F2-427F-46AF-A203-3F8F91AEB039",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:5.5.0:94592:*:*:*:*:*:*",
              "matchCriteriaId": "C1B47446-7E43-44ED-A734-4C300ED6F6CC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.0.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "AE6362C1-9B7D-415F-A6E7-22EB6D9485E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.0.2:90947:*:*:*:*:*:*",
              "matchCriteriaId": "5617A797-C295-4534-A8BD-DB7637FEDDA1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.0.2:93351:*:*:*:*:*:*",
              "matchCriteriaId": "924A87A5-6809-4D3A-B660-4F3D3E930103",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.0.2:94597:*:*:*:*:*:*",
              "matchCriteriaId": "B046FAAA-2FC4-4F69-980B-878BA24D1ACE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.0.2:97682:*:*:*:*:*:*",
              "matchCriteriaId": "231DF541-0D13-42DD-9392-A269999DA50C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.1.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "FA3AD87F-BF18-48A2-8344-197185D974B0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.1.0:1016923:*:*:*:*:*:*",
              "matchCriteriaId": "F3462449-36BD-4FB6-BB40-B06F0EDE570A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.1.0:1031903:*:*:*:*:*:*",
              "matchCriteriaId": "5ED03A42-9D5F-4347-BA8D-DA1B5D5C771A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.1.0:1077664:*:*:*:*:*:*",
              "matchCriteriaId": "41C31238-7B7A-4057-867B-B3A35690A77A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.1.0:1209934:*:*:*:*:*:*",
              "matchCriteriaId": "AA263B4A-4954-4A7F-B202-D31636B210E0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.1.0:1271079:*:*:*:*:*:*",
              "matchCriteriaId": "6E56CB67-2C93-4AD4-87B4-31B337D99B5F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.1.0:848144:*:*:*:*:*:*",
              "matchCriteriaId": "6CE8BB23-1EEA-41EF-BEC5-EAC5DE7F095F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.2.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "9E7FE2E0-AA0B-4D86-B5B3-4E1417691CC5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.2.0:1271082:*:*:*:*:*:*",
              "matchCriteriaId": "41AE1B48-EB15-4249-97B0-FF8BDF6A783A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.2.0:1321594:*:*:*:*:*:*",
              "matchCriteriaId": "AAC380C5-0CD4-4FEF-BF40-A06BFF5BA084",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.2.0:1473927:*:*:*:*:*:*",
              "matchCriteriaId": "AC26F0D1-53C8-40A5-AE07-7064D45E08DD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based attacker with specific knowledge of the Cortex XSOAR instance to access protected resources and perform unauthorized actions on the Cortex XSOAR server. This issue impacts: Cortex XSOAR 5.5.0 builds earlier than 1578677; Cortex XSOAR 6.0.2 builds earlier than 1576452; Cortex XSOAR 6.1.0 builds earlier than 1578663; Cortex XSOAR 6.2.0 builds earlier than 1578666. All Cortex XSOAR instances hosted by Palo Alto Networks are protected from this vulnerability; no additional action is required for these instances."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de verificaci\u00f3n inapropiada de la firma criptogr\u00e1fica en la autenticaci\u00f3n SAML de Cortex XSOAR que permite a un atacante no autenticado basado en la red con conocimiento espec\u00edfico de la instancia de Cortex XSOAR acceder a recursos protegidos y llevar a cabo acciones no autorizadas en el servidor de Cortex XSOAR. Este problema afecta: Cortex XSOAR 5.5.0 builds anteriores a 1578677; Cortex XSOAR 6.0.2 builds anteriores a 1576452; Cortex XSOAR 6.1.0 builds anteriores a 1578663; Cortex XSOAR 6.2.0 builds anteriores a 1578666. Todas las instancias de Cortex XSOAR alojadas por Palo Alto Networks est\u00e1n protegidas contra esta vulnerabilidad; no es requerida ninguna acci\u00f3n adicional para estas instancias"
    }
  ],
  "id": "CVE-2021-3051",
  "lastModified": "2026-06-17T04:04:38.253",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "psirt@paloaltonetworks.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-09-08T17:15:11.777",
  "references": [
    {
      "source": "psirt@paloaltonetworks.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.paloaltonetworks.com/CVE-2021-3051"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.paloaltonetworks.com/CVE-2021-3051"
    }
  ],
  "sourceIdentifier": "psirt@paloaltonetworks.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ],
      "source": "psirt@paloaltonetworks.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2021-3051 (GCVE-0-2021-3051)

Vulnerability from cvelistv5 – Published: 2021-09-08 17:10 – Updated: 2024-09-17 01:10

Title

Cortex XSOAR: Authentication Bypass in SAML Authentication

Summary

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

palo_alto mitre root

References

1 reference

URL	Tags
https://security.paloaltonetworks.com/CVE-2021-3051	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Palo Alto Networks	Cortex XSOAR	Affected: 5.5.0 , < 1578677 (custom) Affected: 6.0.2 , < 1576452 (custom) Affected: 6.1.0 , < 1578663 (custom) Affected: 6.2.0 , < 1578666 (custom)

Date Public

2021-09-08 00:00

Credits

This issue was found by a customer of Palo Alto Networks during a security review.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:45:51.050Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2021-3051"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cortex XSOAR",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "1578677",
                  "status": "unaffected"
                }
              ],
              "lessThan": "1578677",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "1576452",
                  "status": "unaffected"
                }
              ],
              "lessThan": "1576452",
              "status": "affected",
              "version": "6.0.2",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "1578663",
                  "status": "unaffected"
                }
              ],
              "lessThan": "1578663",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "1578666",
                  "status": "unaffected"
                }
              ],
              "lessThan": "1578666",
              "status": "affected",
              "version": "6.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "This issue is applicable only to Cortex XSOAR configurations with SAML authentication integration enabled.\n\nYou can determine if your configuration has SAML authentication integration enabled by selecting \u0027Settings \u003e Servers \u0026 Services\u0027 and searching for \u0027SAML\u0027."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was found by a customer of Palo Alto Networks during a security review."
        }
      ],
      "datePublic": "2021-09-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based attacker with specific knowledge of the Cortex XSOAR instance to access protected resources and perform unauthorized actions on the Cortex XSOAR server. This issue impacts: Cortex XSOAR 5.5.0 builds earlier than 1578677; Cortex XSOAR 6.0.2 builds earlier than 1576452; Cortex XSOAR 6.1.0 builds earlier than 1578663; Cortex XSOAR 6.2.0 builds earlier than 1578666. All Cortex XSOAR instances hosted by Palo Alto Networks are protected from this vulnerability; no additional action is required for these instances."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-08T17:10:16.000Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2021-3051"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "This issue is fixed in Cortex XSOAR 5.5.0 build 1578677, Cortex XSOAR 6.0.2 build 1576452, Cortex XSOAR 6.1.0 build 1578663, Cortex XSOAR 6.2.0 build 1578666, and all later Cortex XSOAR versions."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2021-09-08T00:00:00.000Z",
          "value": "Initial publication"
        }
      ],
      "title": "Cortex XSOAR: Authentication Bypass in SAML Authentication",
      "workarounds": [
        {
          "lang": "en",
          "value": "To completely prevent this issue from being exploited before you can upgrade your Cortex XSOAR server, disable SAML authentication integration.\n\nYou can also restrict network access to the Cortex XSOAR server to allow only trusted users to further reduce the impact of this issue."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@paloaltonetworks.com",
          "DATE_PUBLIC": "2021-09-08T16:00:00.000Z",
          "ID": "CVE-2021-3051",
          "STATE": "PUBLIC",
          "TITLE": "Cortex XSOAR: Authentication Bypass in SAML Authentication"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cortex XSOAR",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "5.5.0",
                            "version_value": "1578677"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "6.0.2",
                            "version_value": "1576452"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "6.1.0",
                            "version_value": "1578663"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "6.2.0",
                            "version_value": "1578666"
                          },
                          {
                            "version_affected": "!\u003e=",
                            "version_name": "5.5.0",
                            "version_value": "1578677"
                          },
                          {
                            "version_affected": "!\u003e=",
                            "version_name": "6.0.2",
                            "version_value": "1576452"
                          },
                          {
                            "version_affected": "!\u003e=",
                            "version_name": "6.1.0",
                            "version_value": "1578663"
                          },
                          {
                            "version_affected": "!\u003e=",
                            "version_name": "6.2.0",
                            "version_value": "1578666"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Palo Alto Networks"
              }
            ]
          }
        },
        "configuration": [
          {
            "lang": "en",
            "value": "This issue is applicable only to Cortex XSOAR configurations with SAML authentication integration enabled.\n\nYou can determine if your configuration has SAML authentication integration enabled by selecting \u0027Settings \u003e Servers \u0026 Services\u0027 and searching for \u0027SAML\u0027."
          }
        ],
        "credit": [
          {
            "lang": "eng",
            "value": "This issue was found by a customer of Palo Alto Networks during a security review."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based attacker with specific knowledge of the Cortex XSOAR instance to access protected resources and perform unauthorized actions on the Cortex XSOAR server. This issue impacts: Cortex XSOAR 5.5.0 builds earlier than 1578677; Cortex XSOAR 6.0.2 builds earlier than 1576452; Cortex XSOAR 6.1.0 builds earlier than 1578663; Cortex XSOAR 6.2.0 builds earlier than 1578666. All Cortex XSOAR instances hosted by Palo Alto Networks are protected from this vulnerability; no additional action is required for these instances."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability."
          }
        ],
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-347 Improper Verification of Cryptographic Signature"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.paloaltonetworks.com/CVE-2021-3051",
              "refsource": "MISC",
              "url": "https://security.paloaltonetworks.com/CVE-2021-3051"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "This issue is fixed in Cortex XSOAR 5.5.0 build 1578677, Cortex XSOAR 6.0.2 build 1576452, Cortex XSOAR 6.1.0 build 1578663, Cortex XSOAR 6.2.0 build 1578666, and all later Cortex XSOAR versions."
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2021-09-08T00:00:00.000Z",
            "value": "Initial publication"
          }
        ],
        "work_around": [
          {
            "lang": "en",
            "value": "To completely prevent this issue from being exploited before you can upgrade your Cortex XSOAR server, disable SAML authentication integration.\n\nYou can also restrict network access to the Cortex XSOAR server to allow only trusted users to further reduce the impact of this issue."
          }
        ],
        "x_affectedList": [
          "Cortex XSOAR 6.2.0",
          "Cortex XSOAR 6.1.0",
          "Cortex XSOAR 6.0.2",
          "Cortex XSOAR 5.5.0"
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2021-3051",
    "datePublished": "2021-09-08T17:10:16.586Z",
    "dateReserved": "2021-01-06T00:00:00.000Z",
    "dateUpdated": "2024-09-17T01:10:46.128Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.