CVE-2024-5910
Expedition: Missing Authentication Leads to Admin Account Takeover
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Expedition: Missing Authentication Leads to Admin Account Takeover
| Assigner | palo_alto |
| Reserved | 2024-06-12 |
| Published | 2024-07-10 |
| Updated | 2024-08-01 |
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.
| CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:D/RE:M/U:Red |
CWE-306 Missing Authentication for Critical Function
| 2024-07-10: | Initial publication |
Brian Hysell (Synopsys CyRC)
https://security.paloaltonetworks.com/CVE-2024-5910
