CVE-2021-3063
Last modified
CVE-2021-3063 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An improper handling of exceptional conditions vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to send specifically crafted traffic to a GlobalProtect interface that causes the service to stop responding. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. EPSS estimates a 0.90% chance of exploitation in the next 30 days.
Description
An improper handling of exceptional conditions vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to send specifically crafted traffic to a GlobalProtect interface that causes the service to stop responding. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h4; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8-h4; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers are not impacted by this issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Paloaltonetworks | Pan-Os | >= 8.1.0, < 8.1.21 |
| Paloaltonetworks | Pan-Os | >= 9.0.0, <= 9.0.14 |
| Paloaltonetworks | Pan-Os | >= 9.1.0, <= 9.1.11 |
| Paloaltonetworks | Pan-Os | >= 10.0.0, <= 10.0.8 |
| Paloaltonetworks | Pan-Os | >= 10.1.0, < 10.1.3 |
References
- https://security.paloaltonetworks.com/CVE-2021-3063Vendor Advisory
- https://security.paloaltonetworks.com/CVE-2021-3063Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-3063?
How severe is CVE-2021-3063?
How do I fix CVE-2021-3063?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-30624Chromium: CVE-2021-30624 Use after free in Autofill8.8
- CVE-2021-30625Use after free in Selection API in Google Chrome prior to 93…8.8
- CVE-2021-30626Out of bounds memory access in ANGLE in Google Chrome prior …8.8
- CVE-2021-30627Type confusion in Blink layout in Google Chrome prior to 93.…8.8
- CVE-2021-30628Stack buffer overflow in ANGLE in Google Chrome prior to 93.…8.8
- CVE-2021-30629Use after free in Permissions in Google Chrome prior to 93.0…8.8
- CVE-2021-30630Inappropriate implementation in Blink in Google Chrome prior…4.3
- CVE-2021-30631Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2021-30632Out of bounds write in V8 in Google Chrome prior to 93.0.457…8.8
- CVE-2021-30633Use after free in Indexed DB API in Google Chrome prior to 9…9.6
- CVE-2021-30635Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a…5.3
- CVE-2021-30636In MediaTek LinkIt SDK before 4.6.1, there is a possible mem…9.8
Are you affected by CVE-2021-3063?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST