CVE-2021-3033
Summary
| CVE | CVE-2021-3033 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-02-10 18:15:00 UTC |
| Updated | 2021-02-17 16:20:00 UTC |
| Description | An improper verification of cryptographic signature vulnerability exists in the Palo Alto Networks Prisma Cloud Compute console. This vulnerability enables an attacker to bypass signature validation during SAML authentication by logging in to the Prisma Cloud Compute console as any authorized user. This issue impacts: All versions of Prisma Cloud Compute 19.11, Prisma Cloud Compute 20.04, and Prisma Cloud Compute 20.09; Prisma Cloud Compute 20.12 before update 1. Prisma Cloud Compute SaaS version is not impacted by this vulnerability. |
Risk And Classification
Problem Types: CWE-347
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Paloaltonetworks | Prisma Cloud | 19.11 | - | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 19.11 | update_1 | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 19.11 | update_2 | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 20.04 | - | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 20.04 | update_1 | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 20.04 | update_2 | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 20.09 | - | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 20.09 | update_1 | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 20.09 | update_2 | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 20.12 | - | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 19.11 | - | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 19.11 | update_1 | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 19.11 | update_2 | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 20.04 | - | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 20.04 | update_1 | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 20.04 | update_2 | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 20.09 | - | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 20.09 | update_1 | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 20.09 | update_2 | All | All |
| Application | Paloaltonetworks | Prisma Cloud | 20.12 | - | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| CVE-2021-3033 Prisma Cloud Compute: SAML Authentication Bypass Vulnerability in Console | MISC | security.paloaltonetworks.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: This issue was found by Palo Alto Networks during internal security review.
There are currently no legacy QID mappings associated with this CVE.