ByteOS Network

Vulnerability Details :

CVE-2021-3032

Assigner Org ID-d6c1279f-00f6-4ef7-9217-f89ffe703ec0

Published At-13 Jan, 2021 | 18:10

Updated At-16 Sep, 2024 | 22:45

PAN-OS: Configuration secrets for log forwarding may be logged in system logs

An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “snmptrap” v3 log forwarding server profiles can be logged to the logrcvr.log system log. Logged information may include up to 1024 bytes of the configuration including the username and password in an encrypted form and private keys used in any certificate profiles set for log forwarding server profiles. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.18; PAN-OS 9.0 versions earlier than PAN-OS 9.0.12; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:palo_alto

Assigner Org ID:d6c1279f-00f6-4ef7-9217-f89ffe703ec0

Published At:13 Jan, 2021 | 18:10

Updated At:16 Sep, 2024 | 22:45

▼CVE Numbering Authority (CNA)

PAN-OS: Configuration secrets for log forwarding may be logged in system logs

Affected Products

Vendor

Palo Alto Networks, Inc.

Product

PAN-OS

Versions

Affected

From 8.1 before 8.1.18 (custom)
- -> unaffectedfrom8.1.18
From 9.0 before 9.0.12 (custom)
- -> unaffectedfrom9.0.12
From 9.1 before 9.1.4 (custom)
- -> unaffectedfrom9.1.4
From 10.0 before 10.0.1 (custom)
- -> unaffectedfrom10.0.1

Problem Types

Type	CWE ID	Description
CWE	CWE-532	CWE-532 Information Exposure Through Log Files

Type: CWE

CWE ID: CWE-532

Description: CWE-532 Information Exposure Through Log Files

Metrics

Version	Base score	Base severity	Vector
3.1	4.4	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Version: 3.1

Base score: 4.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Solutions

If the PAN-OS firewall is impacted, then you must clear the configuration file (/var/log/pan/logrcvr.log). This can be accomplished by running the following CLI command: "delete debug-log mp-log file logrcvr.log". This issue is fixed in PAN-OS 8.1.18, PAN-OS 9.0.12, PAN-OS 9.1.4, PAN-OS 10.0.1, and all later PAN-OS versions.

Configurations

This issue is only applicable to PAN-OS devices configured to use log forwarding. You can verify this in the management web interface: Device -> Log Settings.

Workarounds

This issue requires access to PAN-OS log files generated in the system. You can mitigate the impact of this issue by following best practices for securing the PAN-OS management interface. Please review the Best Practices for Securing Administrative Access in the PAN-OS technical documentation, available at https://docs.paloaltonetworks.com/best-practices.

Exploits

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Credits

This issue was found by My Tran, Mai Phan, and Claire Zhou of Palo Alto Networks during internal security testing.

Timeline

Event	Date
Initial publication	2021-01-13 00:00:00

Event: Initial publication

Date: 2021-01-13 00:00:00

References

Hyperlink	Resource
https://security.paloaltonetworks.com/CVE-2021-3032	x_refsource_MISC

Hyperlink: https://security.paloaltonetworks.com/CVE-2021-3032

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://security.paloaltonetworks.com/CVE-2021-3032	x_refsource_MISC x_transferred

Hyperlink: https://security.paloaltonetworks.com/CVE-2021-3032

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:psirt@paloaltonetworks.com

Published At:13 Jan, 2021 | 18:15

Updated At:19 Jan, 2021 | 23:05

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	4.4	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 4.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Type: Primary

Version: 2.0

Base score: 2.1

Base severity: LOW

Vector:

AV:L/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

Palo Alto Networks, Inc.

>>pan-os>>Versions from 8.1.0(inclusive) to 8.1.18(exclusive)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Palo Alto Networks, Inc.

>>pan-os>>Versions from 9.0.0(inclusive) to 9.0.12(exclusive)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Palo Alto Networks, Inc.

>>pan-os>>Versions from 9.1.0(inclusive) to 9.1.4(exclusive)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Palo Alto Networks, Inc.

>>pan-os>>Versions from 10.0.0(inclusive) to 10.0.1(exclusive)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-532	Primary	nvd@nist.gov
CWE-532	Secondary	psirt@paloaltonetworks.com

CWE ID: CWE-532

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-532

Type: Secondary

Source: psirt@paloaltonetworks.com

References

Hyperlink	Source	Resource
https://security.paloaltonetworks.com/CVE-2021-3032	psirt@paloaltonetworks.com	Vendor Advisory

Hyperlink: https://security.paloaltonetworks.com/CVE-2021-3032

Source: psirt@paloaltonetworks.com

Resource:

Vendor Advisory

Similar CVEs

202Records found

CVE-2020-7215

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.13% / 33.10%

7 Day CHG~0.00%

Published-20 Jan, 2020 | 05:32

Updated-04 Aug, 2024 | 09:25

An issue was discovered in Gallagher Command Centre 7.x before 7.90.991(MR5), 8.00 before 8.00.1161(MR5), and 8.10 before 8.10.1134(MR4). External system configuration data (used for third party integrations such as DVR systems) were logged in the Command Centre event trail. Any authenticated operator with the 'view events' privilege could see the full configuration, including cleartext usernames and passwords, under the event details of a Modified DVR System event.

Vendor-n/a Gallagher Group Ltd.

Product-command_centre n/a

CWE ID-CWE-532

Insertion of Sensitive Information into Log File

CVE-2020-5262

Matching Score-4

Assigner-GitHub, Inc.

View Details

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-7.7||HIGH

EPSS-0.07% / 21.21%

7 Day CHG~0.00%

Published-19 Mar, 2020 | 17:05

Updated-04 Aug, 2024 | 08:22

GitHub personal access token leaking into temporary EasyBuild (debug) logs

In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`, etc.) is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the `master`+ `develop` branches of the `easybuild-framework` repository.

Vendor-easybuild_project easybuilders

Product-easybuild easybuild-framework

CWE ID-CWE-532

Insertion of Sensitive Information into Log File

CWE ID-CWE-922

Insecure Storage of Sensitive Information

CVE-2021-3032

Credits

PAN-OS: Configuration secrets for log forwarding may be logged in system logs

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs