CVE-2021-3054

PAN-OS: Unsigned Code Execution During Plugin Installation Race Condition Vulnerability

State: Published
Severity: 7.2 High
Published: Sep 8, 2021
Updated: Sep 16, 2024
Reserved: Jan 6, 2021

Description

A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permission to upload plugins to execute arbitrary code with root user privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earlier than PAN-OS 10.0.7; PAN-OS 10.1 versions earlier than PAN-OS 10.1.2. This issue does not affect Prisma Access.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	palo_alto

Weaknesses

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

Affected Products

Product	Versions
PAN-OSPalo Alto Networks	8.1 to before 8.1.20Affectedfrom 8.1.20Not affected 9.0 to before 9.0.14Affectedfrom 9.0.14Not affected 10.0 to before 10.0.7Affectedfrom 10.0.7Not affected 9.1 to before 9.1.11Affectedfrom 9.1.11Not affected 10.1 to before 10.1.2Affectedfrom 10.1.2Not affected

References

https://security.paloaltonetworks.com/CVE-2021-3054

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.