CVE-2024-5910 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.

Reserved 2024-06-12 | Published 2024-07-10 | Updated 2024-11-08 | Assigner palo_alto

CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:D/RE:M/U:Red

CISA Known Exploited Vulnerability

Date added 2024-11-07 | Due date 2024-11-28

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Problem types

CWE-306 Missing Authentication for Critical Function

Product status

Default status

unaffected

1.2 before 1.2.92

affected

Timeline

2024-07-10:

Initial publication

Credits

Brian Hysell (Synopsys CyRC) finder

References

security.paloaltonetworks.com/CVE-2024-5910 vendor-advisory

cve.org (CVE-2024-5910)

nvd.nist.gov (CVE-2024-5910)

Download JSON

https://cve.threatint.com/CVE/CVE-2024-5910

Support options

Helpdesk Chat, Email, Knowledgebase