CVE-2021-3062

PAN-OS: Improper Access Control Vulnerability Exposing AWS Instance Metadata Endpoint to GlobalProtect Users

State: Published
Severity: 8.1 High
Published: Nov 10, 2021
Updated: Sep 17, 2024
Reserved: Jan 6, 2021

Description

An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to perform any operations allowed by the EC2 role in AWS. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20 VM-Series firewalls; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11 VM-Series firewalls; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14 VM-Series firewalls; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8 VM-Series firewalls. Prisma Access customers are not impacted by this issue.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	palo_alto

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
PAN-OSPalo Alto Networks	10.1.*Not affected 9.1 to before 9.1.11Affectedfrom 9.1.11Not affected 8.1 to before 8.1.20Affectedfrom 8.1.20Not affected 9.0 to before 9.0.14Affectedfrom 9.0.14Not affected 10.0 to before 10.0.8Affectedfrom 10.0.8Not affected
Prisma AccessPalo Alto Networks	2.1 allNot affected 2.2 allNot affected

References

https://security.paloaltonetworks.com/CVE-2021-3062

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.