Skip to content
CVE PROGRAM SOURCE RECORD4.4 Medium

CVE-2021-3036

PAN-OS: Administrator secrets are logged in web server logs when using the PAN-OS XML API incorrectly

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
palo_alto

Description

An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in cleartext to the web server logs when the API is used incorrectly. This vulnerability applies only to PAN-OS appliances that are configured to use the PAN-OS XML API and exists only when a client includes a duplicate API parameter in API requests. Logged information includes the cleartext username, password, and API key of the administrator making the PAN-OS XML API request.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palo Alto Networks PAN-OS

  • 8.1 to < 8.1.19affected
  • 9.0 to < 9.0.12affected
  • 9.1 to < 9.1.6affected
  • 10.0 to < 10.0.1affected

References