CVE-2021-3033
Last modified
CVE-2021-3033 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. An improper verification of cryptographic signature vulnerability exists in the Palo Alto Networks Prisma Cloud Compute console. This vulnerability enables an attacker to bypass signature validation during SAML authentication by logging in to the Prisma Cloud Compute console as any authorized user. EPSS estimates a 1.21% chance of exploitation in the next 30 days.
Description
An improper verification of cryptographic signature vulnerability exists in the Palo Alto Networks Prisma Cloud Compute console. This vulnerability enables an attacker to bypass signature validation during SAML authentication by logging in to the Prisma Cloud Compute console as any authorized user. This issue impacts: All versions of Prisma Cloud Compute 19.11, Prisma Cloud Compute 20.04, and Prisma Cloud Compute 20.09; Prisma Cloud Compute 20.12 before update 1. Prisma Cloud Compute SaaS version is not impacted by this vulnerability.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Paloaltonetworks | Prisma Cloud | 19.11 |
| Paloaltonetworks | Prisma Cloud | 20.04 |
| Paloaltonetworks | Prisma Cloud | 20.09 |
| Paloaltonetworks | Prisma Cloud | 20.12 |
References
- https://security.paloaltonetworks.com/CVE-2021-3033Third Party Advisory
- https://security.paloaltonetworks.com/CVE-2021-3033Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-3033?
How severe is CVE-2021-3033?
How do I fix CVE-2021-3033?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-30324Possible out of bound write due to lack of boundary check fo…6.7
- CVE-2021-30325Possible out of bound access of DCI resources due to lack of…6.7
- CVE-2021-30326Possible assertion due to improper size validation while pro…7.5
- CVE-2021-30327Buffer overflow in sahara protocol while processing commands…6.8
- CVE-2021-30328Possible assertion due to improper validation of invalid NR …7.5
- CVE-2021-30329Possible assertion due to improper validation of TCI configu…7.5
- CVE-2021-30330Possible null pointer dereference due to improper validation…7.5
- CVE-2021-30331Possible buffer overflow due to improper data validation of …5.5
- CVE-2021-30332Possible assertion due to improper validation of OTA configu…7.5
- CVE-2021-30333Improper validation of buffer size input to the EFS file can…7.8
- CVE-2021-30334Possible use after free due to lack of null check of DRM fil…7.8
- CVE-2021-30335Possible assertion in QOS request due to improper validation…7.8
Are you affected by CVE-2021-3033?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST