- Vulnerability/
- CVE-2024-5910
CVE-2024-5910: Expedition: Missing Authentication Leads to Admin Account Takeover (Severity: CRITICAL)
First published: Wed Jul 10 2024(Updated: )
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.
Credit: psirt@paloaltonetworks.com psirt@paloaltonetworks.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Palo Alto Networks Expedition | ||
| Paloaltonetworks Expedition | >=1.2.0<1.2.92 | |
| Palo Alto Networks Expedition | <1.2.92=1.2 | 1.2.92 |
Remedy
This issue is fixed in Expedition 1.2.92 and all later versions.
Remedy
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Remedy
Ensure network access to Expedition is restricted to authorized users, hosts, or networks.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-firewall-hijack-bugs-with-public-exploit/
- https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-palo-alto-networks-bug-exploited-in-attacks/
- https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-potential-pan-os-rce-vulnerability/
- https://security.paloaltonetworks.com/CVE-2024-5910
- https://nvd.nist.gov/vuln/detail/CVE-2024-5910
- https://www.bleepingcomputer.com/news/security/cisa-warns-of-more-palo-alto-networks-bugs-exploited-in-attacks/
- https://www.bleepingcomputer.com/news/security/palo-alto-networks-patches-two-firewall-zero-days-used-in-attacks/
- https://www.bleepingcomputer.com/news/security/over-2-000-palo-alto-firewalls-hacked-using-recently-patched-bugs/
- https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise
- agent/weakness
- agent/type
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2024-5910
- alias/CVE-2024-9464
- alias/CVE-2024-9466
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/description
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- alias/CVE-2024-9463
- alias/CVE-2024-9465
- alias/CVE-2024-0012
- alias/CVE-2024-9474
- alias/CVE-2024-3400
- collector/nvd-api
- source/NVD
- agent/references
- agent/last-modified-date
- collector/paloaltonetworks-latest
- source/Palo Alto Networks
- agent/title
- agent/severity
- agent/event
- agent/first-publish-date
- collector/nvd-cve
- collector/paloaltonetworks-api
- agent/remedy
- agent/softwarecombine
- agent/tags
- agent/trending
- vendor/palo alto networks
- canonical/palo alto networks expedition
- vendor/paloaltonetworks
- canonical/paloaltonetworks expedition
- version/paloaltonetworks expedition/1.2.0
- version/palo alto networks expedition/1.2