Palo Alto Networks Product Security Incident Response TeamPAN-SA-2019-0014Code Injection Vulnerability in Traps
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
6.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
0.001 Low
EPSS
Percentile
31.6%
Code injection vulnerability exists in the Palo Alto Networks Traps. (Ref: CVE-2019-1577)
Successful exploitation of this issue may allow an authenticated attacker to inject arbitrary JavaScript or HTML.
This issue affects Traps 5.0.5 and earlier, including all 4.x releases. These releases did not have the file protection (SPROT) enabled by default. Traps 5.0.6, 6.0 and later are NOT affected.
Work around:
Configure Agent Security options that prevent unauthorized access or tampering with Traps components. Instructions are located on (see step 6) https://docs.paloaltonetworks.com/traps/tms/traps-management-service-admin/manage-endpoint-policy/traps-profiles/add-agent-settings-profile
Related
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
6.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
0.001 Low
EPSS
Percentile
31.6%