CVE-2021-3043

Prisma Cloud: Cross-Site Scripting (XSS) Vulnerability in Prisma Cloud Compute Web Console

Severity Score

4.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A reflected cross-site scripting (XSS) vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console while an authenticated administrator is using that web interface. Prisma Cloud Compute SaaS versions were automatically upgraded to the fixed release. No additional action is required for these instances. This issue impacts: Prisma Cloud Compute 20.12 versions earlier than Prisma Cloud Compute 20.12.552; Prisma Cloud Compute 21.04 versions earlier than Prisma Cloud Compute 21.04.439.

Se presenta una vulnerabilidad de tipo cross-site scripting (XSS) reflejado en Prisma Cloud Compute web console que permite a un atacante remoto ejecutar código JavaScript arbitrario en la consola web basada en el navegador mientras un administrador autenticado está usando esa interfaz web. Unas versiones de Prisma Cloud Compute SaaS se actualizaron automáticamente a la versión corregida. No se requiere ninguna acción adicional para estas instancias. Este problema afecta: Prisma Cloud Compute versión 20.12 versiones anteriores a Prisma Cloud Compute 20.12.552; Prisma Cloud Compute versiones 21.04 anteriores a Prisma Cloud Compute versión 21.04.439

*Credits: This issue was found during an internal security review.

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-01-06 CVE Reserved
2021-07-15 CVE Published
2023-03-08 EPSS Updated
2024-09-17 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://security.paloaltonetworks.com/CVE-2021-3043	2021-07-27

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Paloaltonetworks Search vendor "Paloaltonetworks"		Prisma Cloud Search vendor "Paloaltonetworks" for product "Prisma Cloud"				>= 20.12 < 20.12.552 Search vendor "Paloaltonetworks" for product "Prisma Cloud" and version " >= 20.12 < 20.12.552"		compute		Affected
Paloaltonetworks Search vendor "Paloaltonetworks"		Prisma Cloud Search vendor "Paloaltonetworks" for product "Prisma Cloud"				>= 21.04 < 21.04.439 Search vendor "Paloaltonetworks" for product "Prisma Cloud" and version " >= 21.04 < 21.04.439"		compute		Affected