Paper/Archive/CVE-2024-5910

CVE-2024-5910

Palo Alto Networks Expedition — Expedition: Missing Authentication Leads to Admin Account Takeover

KEV · due 28 Nov EPSS 92%public exploit SSVC act CVSS 9.3

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 In CISA KEV+3030.0 EPSS percentile 99.8.998 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.

Affected

ProductAffectedFixed inSource

Expedition1.2 – < 1.2.921.2.92CNA

expedition1.2 – < 1.2.921.2.92CISA-ADP

Scores by source

palo_alto (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:D/RE:M/U:Red

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

advisorysecurity.paloaltonetworks.com/CVE-2024-5910 refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-5910 refhorizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise kevcisa.gov/known-exploited-vulnerabilities-catalog