Code injection vulnerability exists in the Palo Alto Networks Traps. (Ref: CVE-2019-1577)
This issue affects Traps 5.0.5 and earlier, including all 4.x releases. These releases did not have the file protection (SPROT) enabled by default. Traps 5.0.6, 6.0 and later are NOT affected.
|Traps 6.0||None||>= 6.0.*|
|Traps 5.0||<= 5.0.5||>= 5.0.6|
CVSSv3.1 Base Score: 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Traps 5.0.6 and later
Configure Agent Security options that prevent unauthorized access or tampering with Traps components. Instructions are located on (see step 6) https://docs.paloaltonetworks.com/traps/tms/traps-management-service-admin/manage-endpoint-policy/traps-profiles/add-agent-settings-profile