CVE-2021-3034

paloaltonetworks cortex xsoar

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-3034

Katalog CVE

CVSS 5.1 · Medium EPSS 0,17%

Kerentanan Insertion of Sensitive Information into Log File pada paloaltonetworks cortex xsoar. Skor CVSS 3.1 5.1 (Medium) menurut paloaltonetworks.com.

Deskripsi (NVD)

An information exposure through log file vulnerability exists in Cortex XSOAR software where the secrets configured for the SAML single sign-on (SSO) integration can be logged to the '/var/log/demisto/' server logs when testing the integration during setup. This logged information includes the private key and identity provider certificate used to configure the SAML SSO integration. This issue impacts: Cortex XSOAR 5.5.0 builds earlier than 98622; Cortex XSOAR 6.0.1 builds earlier than 830029; Cortex XSOAR 6.0.2 builds earlier than 98623; Cortex XSOAR 6.1.0 builds earlier than 848144.

Rincian

Terbit di NVD
10 Maret 2021
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
5.1 (Medium), sumber paloaltonetworks.com
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-532: Insertion of Sensitive Information into Log File
EPSS (30 hari)
0,17% peluang dieksploitasi; lebih tinggi dari 5,4% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
paloaltonetworks cortex xsoar Versi 5.5.0
paloaltonetworks cortex xsoar Versi 5.5.0 70066
paloaltonetworks cortex xsoar Versi 5.5.0 73387
paloaltonetworks cortex xsoar Versi 5.5.0 75211
paloaltonetworks cortex xsoar Versi 5.5.0 78518
paloaltonetworks cortex xsoar Versi 5.5.0 94592
paloaltonetworks cortex xsoar Versi 6.0.1
paloaltonetworks cortex xsoar Versi 6.0.1 81077
paloaltonetworks cortex xsoar Versi 6.0.2
paloaltonetworks cortex xsoar Versi 6.0.2 90947
paloaltonetworks cortex xsoar Versi 6.0.2 93351
paloaltonetworks cortex xsoar Versi 6.0.2 94597
paloaltonetworks cortex xsoar Versi 6.0.2 97682
paloaltonetworks cortex xsoar Versi 6.1.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.