CVE-2021-3044

An improper authorization vulnerability in Palo Alto Networks Cortex XSOAR enables a remote unauthenticated attacker with network access to the Cortex XSOAR server to perform unauthorized actions through the REST API. This issue impacts: Cortex XSOAR 6.1.0 builds later than 1016923 and earlier than 1271064; Cortex XSOAR 6.2.0 builds earlier than 1271065. This issue does not impact Cortex XSOAR 5.5.0, Cortex XSOAR 6.0.0, Cortex XSOAR 6.0.1, or Cortex XSOAR 6.0.2 versions. All Cortex XSOAR instances hosted by Palo Alto Networks are upgraded to resolve this vulnerability. No additional action is required for these instances.

• CWE-285

• https://security.paloaltonetworks.com/CVE-2021-3044Vendor Advisory
• https://security.paloaltonetworks.com/CVE-2021-3044Vendor Advisory

Published

Jun 22, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3038A denial-of-service (DoS) vulnerability in Palo Alto Network…5.5
• CVE-2021-3039An information exposure through log file vulnerability exist…3.8
• CVE-2021-3040An unsafe deserialization vulnerability in Bridgecrew Checko…7.2
• CVE-2021-3041A local privilege escalation vulnerability exists in the Pal…7.8
• CVE-2021-3042A local privilege escalation (PE) vulnerability exists in th…7.8
• CVE-2021-3043A reflected cross-site scripting (XSS) vulnerability exists …4.8
• CVE-2021-3045An OS command argument injection vulnerability in the Palo A…4.9
• CVE-2021-30454An issue was discovered in the outer_cgi crate before 0.2.1 …9.8
• CVE-2021-30455An issue was discovered in the id-map crate through 2021-02-…9.8
• CVE-2021-30456An issue was discovered in the id-map crate through 2021-02-…9.8
• CVE-2021-30457An issue was discovered in the id-map crate through 2021-02-…9.8
• CVE-2021-30458An issue was discovered in Wikimedia Parsoid before 0.11.1 a…6.1