CVE-2021-3043

Prisma Cloud: Cross-Site Scripting (XSS) Vulnerability in Prisma Cloud Compute Web Console

State: Published
Severity: 7.5 High
Published: Jul 15, 2021
Updated: Sep 17, 2024
Reserved: Jan 6, 2021

Description

A reflected cross-site scripting (XSS) vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console while an authenticated administrator is using that web interface. Prisma Cloud Compute SaaS versions were automatically upgraded to the fixed release. No additional action is required for these instances. This issue impacts: Prisma Cloud Compute 20.12 versions earlier than Prisma Cloud Compute 20.12.552; Prisma Cloud Compute 21.04 versions earlier than Prisma Cloud Compute 21.04.439.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	palo_alto

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
Prisma Cloud ComputePalo Alto Networks	21.04 to before 21.04.439Affectedfrom 21.04.439Not affected 20.12 to before 20.12.552Affectedfrom 20.12.552Not affected

References

https://security.paloaltonetworks.com/CVE-2021-3043

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.