« Volver al listado

CVE-2021-3059

Estado: ModificadaAlta (8.1)—

An OS command injection vulnerability in the Palo Alto Networks PAN-OS management interface exists when performing dynamic updates. This vulnerability enables a man-in-the-middle attacker to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers that have Prisma Access 2.1 Preferred or Prisma Access 2.1 Innovation firewalls are impacted by this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Paloaltonetworks — Pan-os

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-3059",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "HIGH",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@paloaltonetworks.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@paloaltonetworks.com",
      "affectedData": [
        {
          "vendor": "Palo Alto Networks",
          "product": "PAN-OS",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "10.0.8",
                  "status": "unaffected"
                }
              ],
              "version": "10.0",
              "lessThan": "10.0.8",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "10.1.3",
                  "status": "unaffected"
                }
              ],
              "version": "10.1",
              "lessThan": "10.1.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "8.1.20-h1",
                  "status": "unaffected"
                }
              ],
              "version": "8.1",
              "lessThan": "8.1.20-h1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "9.0.14-h3",
                  "status": "unaffected"
                }
              ],
              "version": "9.0",
              "lessThan": "9.0.14-h3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "9.1.11-h2",
                  "status": "unaffected"
                }
              ],
              "version": "9.1",
              "lessThan": "9.1.11-h2",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "Prisma Access",
          "versions": [
            {
              "status": "affected",
              "version": "2.1 Innovation"
            },
            {
              "status": "affected",
              "version": "2.1 Preferred"
            },
            {
              "status": "unaffected",
              "version": "all",
              "lessThan": "2.2*",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-11-10T17:15:10.030",
  "references": [
    {
      "url": "https://security.paloaltonetworks.com/CVE-2021-3059",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@paloaltonetworks.com"
    },
    {
      "url": "https://security.paloaltonetworks.com/CVE-2021-3059",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@paloaltonetworks.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An OS command injection vulnerability in the Palo Alto Networks PAN-OS management interface exists when performing dynamic updates. This vulnerability enables a man-in-the-middle attacker to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers that have Prisma Access 2.1 Preferred or Prisma Access 2.1 Innovation firewalls are impacted by this issue."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de inyección de comandos del sistema operativo en la interfaz de administración de PAN-OS de Palo Alto Networks cuando se llevan a cabo actualizaciones dinámicas. Esta vulnerabilidad permite a un atacante de tipo \"man-in-the-middle\" ejecutar comandos arbitrarios del sistema operativo para escalar privilegios. Este problema afecta a: PAN-OS versiones 8.1 anteriores a PAN-OS 8.1.20-h1; PAN-OS versiones 9.0 anteriores a PAN-OS 9.0.14-h3; PAN-OS versiones 9.1 anteriores a PAN-OS 9.1.11-h2; PAN-OS versiones 10.0 anteriores a PAN-OS 10.0.8; PAN-OS versiones 10.1 anteriores a PAN-OS 10.1.3. Los clientes de Prisma Access que presentan firewalls Prisma Access versión 2.1 Preferred o Prisma Access versión 2.1 Innovation están afectados por este problema"
    }
  ],
  "lastModified": "2026-06-17T04:04:39.520",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E492841-3CD5-4DDF-B43C-EE04B5556BE2",
              "versionEndIncluding": "8.1.20",
              "versionStartIncluding": "8.1.0"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E95975B-A993-48FE-BA16-C89BEB075CBE",
              "versionEndIncluding": "9.0.14",
              "versionStartIncluding": "9.0.0"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C95A07E-5F94-4907-A283-954B7924DA3A",
              "versionEndIncluding": "9.1.11",
              "versionStartIncluding": "9.1.0"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C408A950-281A-49DC-9376-F1D943280371",
              "versionEndExcluding": "10.0.8",
              "versionStartIncluding": "10.0.0"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40AFDDF3-0AB4-4A18-93E9-01EE5BDE9D2E",
              "versionEndExcluding": "10.1.3",
              "versionStartIncluding": "10.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@paloaltonetworks.com"
}