Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2021-3056

PAN-OS: Memory Corruption Vulnerability in GlobalProtect Clientless VPN During SAML Authentication

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
palo_alto

Description

A memory corruption vulnerability in Palo Alto Networks PAN-OS GlobalProtect Clientless VPN enables an authenticated attacker to execute arbitrary code with root user privileges during SAML authentication. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.9; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1. Prisma Access customers with Prisma Access 2.1 Preferred firewalls are impacted by this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palo Alto Networks PAN-OS

  • 10.1.*unaffected
  • 9.0 to < 9.0.14affected
  • 8.1 to < 8.1.20affected
  • 9.1 to < 9.1.9affected
  • 10.0 to < 10.0.1affected

Palo Alto Networks Prisma Access

  • 2.2 allunaffected
  • 2.1 Preferredaffected
  • 2.1 Innovationunaffected

References