Actively exploited · Published Oct 9, 2024 · Assigned by palo_alto
CVE-2024-9465Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure
Critical 9.2 Exploited
In plain English
A critical-severity SQL injection in Expedition from Palo Alto Networks. Attackers are actively exploiting it in the wild (listed by CISA on November 14, 2024). The chance it is exploited in the next 30 days is estimated at 99.6% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Dec 5, 2024.
Official description
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Palo Alto Networks | Expedition | 1.2.0 – before 1.2.96 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber