Vulnerability Details : CVE-2021-3050
An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 9.0 version 9.0.10 through PAN-OS 9.0.14; PAN-OS 9.1 version 9.1.4 through PAN-OS 9.1.10; PAN-OS 10.0 version 10.0.7 and earlier PAN-OS 10.0 versions; PAN-OS 10.1 version 10.1.0 through PAN-OS 10.1.1. Prisma Access firewalls and firewalls running PAN-OS 8.1 versions are not impacted by this issue.
Products affected by CVE-2021-3050
- cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
- cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-3050
0.26%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 66 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-3050
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.0
|
HIGH | AV:N/AC:L/Au:S/C:C/I:C/A:C |
8.0
|
10.0
|
NIST | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
Palo Alto Networks, Inc. |
CWE ids for CVE-2021-3050
-
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Assigned by:
- nvd@nist.gov (Primary)
- psirt@paloaltonetworks.com (Secondary)
References for CVE-2021-3050
-
https://security.paloaltonetworks.com/CVE-2021-3050
CVE-2021-3050 PAN-OS: OS Command Injection Vulnerability in Web InterfaceVendor Advisory
Jump to