CVE-2021-3032
CVSS V2 Low 2.1
CVSS V3 Medium 4.4
Description
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “snmptrap” v3 log forwarding server profiles can be logged to the logrcvr.log system log. Logged information may include up to 1024 bytes of the configuration including the username and password in an encrypted form and private keys used in any certificate profiles set for log forwarding server profiles. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.18; PAN-OS 9.0 versions earlier than PAN-OS 9.0.12; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.
Overview
- CVE ID
- CVE-2021-3032
- Assigner
- psirt@paloaltonetworks.com
- Vulnerability Status
- Analyzed
- Published Version
- 2021-01-13T18:15:14
- Last Modified Date
- 2021-01-19T23:05:46
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* | 1 | OR | 8.1.0 | 8.1.18 |
| cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* | 1 | OR | 9.0.0 | 9.0.12 |
| cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* | 1 | OR | 9.1.0 | 9.1.4 |
| cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* | 1 | OR | 10.0.0 | 10.0.1 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:L/AC:L/Au:N/C:P/I:N/A:N
- Access Vector
- LOCAL
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- NONE
- Availability Impact
- NONE
- Base Score
- 2.1
- Severity
- LOW
- Exploitability Score
- 3.9
- Impact Score
- 2.9
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Attack Vector
- LOCAL
- Attack Compatibility
- LOW
- Privileges Required
- HIGH
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- NONE
- Base Score
- 4.4
- Base Severity
- MEDIUM
- Exploitability Score
- 0.8
- Impact Score
- 3.6
References
| Reference URL | Reference Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2021-3032 | Vendor Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2021-3032 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3032 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 07:26:51 | Added to TrackCVE | |||
| 2022-12-05 20:02:01 | 2021-01-13T18:15Z | 2021-01-13T18:15:14 | CVE Published Date | updated |
| 2022-12-05 20:02:01 | 2021-01-19T23:05:46 | CVE Modified Date | updated | |
| 2022-12-05 20:02:01 | Analyzed | Vulnerability Status | updated |