CVE-2021-3043

High

Description

A reflected cross-site scripting (XSS) vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console while an authenticated administrator is using that web interface. Prisma Cloud Compute SaaS versions were automatically upgraded to the fixed release. No additional action is required for these instances. This issue impacts: Prisma Cloud Compute 20.12 versions earlier than Prisma Cloud Compute 20.12.552; Prisma Cloud Compute 21.04 versions earlier than Prisma Cloud Compute 21.04.439.

SeverityHigh

CVSS7.5

Exploit probability—

Product

Paloaltonetworks Prisma Cloud

PublishedJul 15, 2021

First seenJul 15, 2021

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

paloaltonetworks prisma_cloud20.12.552, 21.04.439 or later

Affected products

Product	Affected versions	Fixed in
paloaltonetworks prisma_cloud	20.12 ≤ v < 20.12.552, 21.04 ≤ v < 21.04.439	20.12.552, 21.04.439

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.