CVE-2021-3037

Description

An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in system logs. Logged information includes the cleartext username, password, and IP address used to export the PAN-OS configuration to the destination server.

Overview

State

—

Assigner (CNA)

—

CVSS severity

MEDIUM

CVSS score

5.0 / 10

CVSS vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Effective score

5.0 / 10 MEDIUM source: CNA overview

CWE(s)

—

Reserved

—

Published

2021-04-14 00:00 UTC

Last updated

—

Source

https://www.rapid7.com/db/vulnerabilities/panos-cve-2021-3037/

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2021-04-20 04:15:12 UTC

NVD last modified

2026-06-17 04:04:36 UTC

NVD CVSS v3.1

2.3 / 10 LOW source: psirt@paloaltonetworks.com

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Exploitability subscore

0.8 / 10

Impact subscore

1.4 / 10

EPSS score

0.0025 (probability of exploitation in next 30 days)

EPSS percentile

16.54% vs all CVEs — higher = more likely to be exploited, as of 2026-06-29

NVD-assigned CWE(s): CWE-534, CWE-532 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2021-26389

Assigner

palo_alto

Published

Apr 20, 2021, 3:15:17 AM

Updated

Sep 16, 2024, 11:51:58 PM

EUVD base score (CVSS 3.1)

2.3 / 10
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EUVD-reported EPSS

0.2500

Vendors

Palo Alto Networks

Products

PAN-OS (8.1 <8.1.19)

PAN-OS (9.0 <9.0.13)

PAN-OS (9.1 <9.1.4)

Aliases

GHSA-5jf9-w976-2jh9

ENISA description: An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in system logs. Logged information includes the cleartext username, password, and IP address used to export the PAN-OS configuration to the destination server.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (3)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://attackerkb.com/topics/CVE-2021-3037 rapid7:attackerkb.com
• https://security.paloaltonetworks.com/CVE-2021-3037 rapid7:security.paloaltonetworks.com
• https://www.cve.org/CVERecord?id=CVE-2021-3037 rapid7:www.cve.org

• Microsoft Patch Tuesday May 2026 - 120 Vulnerabilities Fixed, Including ...
  web:cybersecuritynews.com

  Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.

  2026-06-04 02:02 UTC
• ‎Google Gemini
  web:gemini.google.com

  Meet Gemini, Google's AI assistant. Get help with writing, planning, brainstorming, and more. Experience the power of generative AI.

  2026-06-04 02:02 UTC
• Security Update Guide - Microsoft
  web:msrc.microsoft.com

  The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

  2026-06-04 02:02 UTC
• NVD - Home
  web:nvd.nist.gov

  The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...

  2026-06-04 02:02 UTC
• February's Patch Tuesday release fixes 59 flaws ... - Computerworld
  web:www.computerworld.com

  Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...

  2026-06-04 02:02 UTC
• CVE: Common Vulnerabilities and Exposures
  web:www.cve.org

  At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

  2026-06-04 02:02 UTC
• Microsoft Patch Tuesday - May 2026 - Lansweeper
  web:www.lansweeper.com

  Which vulnerabilities, issues, and other things did Microsoft update? Discover what's new using Lansweeper's Patch Tuesday May 2026 summary.

  2026-06-04 02:02 UTC
• Microsoft's botched Windows 11 March update has an emergency fix
  web:www.pcworld.com

  Microsoft has released an emergency update for Windows 11. Update KB5086672 is an out-of-band update intended to resolve issues caused by the optional Windows update KB5079391 from late March ...

  2026-06-04 02:02 UTC
• Microsoft Issues Massive Windows Patch for 160+ Bugs ... - TechRepublic
  web:www.techrepublic.com

  Microsoft's April 2026 Patch Tuesday fixes 165 vulnerabilities, including two zero-days, in one of the company's largest monthly security updates.

  2026-06-04 02:02 UTC
• Microsoft confirms Windows 11 January 2026 Update issues, releases fix ...
  web:www.windowslatest.com

  Microsoft has confirmed that the Windows 11 January 2026 Update is causing at least three major issues, rolling out fixes for two bugs.

  2026-06-04 02:02 UTC

Only Available for Registered Users. Sign in to view.