CVE-2021-3035

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.26. Checkov 1.0 versions are not impacted.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Palo Alto Networks	Bridgecrew Checkov	>= 2.0, < 2.0.26

References

https://security.paloaltonetworks.com/CVE-2021-3035Vendor Advisory
https://security.paloaltonetworks.com/CVE-2021-3035Vendor Advisory

Timeline

Published: Apr 20, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-303507.8Lack of MBN header size verification against input buffer can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon C CVE-2021-303519.8An out of bound memory access can occur due to improper validation of number of frames being passed during music playback in Snapdragon Auto CVE-2021-303537.5Improper validation of function pointer type with actual function signature can lead to assertion in Snapdragon Auto, Snapdragon Compute, Sn CVE-2021-303548.6Amazon Kindle e-reader prior to and including version 5.13.4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in func CVE-2021-303558.6Amazon Kindle e-reader prior to and including version 5.13.4 improperly manages privileges, allowing the framework user to elevate privilege CVE-2021-303568.1A denial of service vulnerability was reported in Check Point Identity Agent before R81.018.0000, which could allow low privileged users to CVE-2021-303575.3SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows p CVE-2021-303587.2Mobile Access Portal Native Applications who's path is defined by the administrator with environment variables may run applications from oth CVE-2021-303597.8The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation.CVE-2021-30364.4An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests CVE-2021-303607.8Users have access to the directory where the installation repair occurs. Since the MS Installer allows regular users to run the repair, an a CVE-2021-303616.7The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to inject a comm