Actively exploited · Published Jul 10, 2024 · Assigned by palo_alto
CVE-2024-5910Expedition: Missing Authentication Leads to Admin Account Takeover
Critical 9.3 Exploited
In plain English
A critical-severity missing authentication in Expedition from Palo Alto Networks. Attackers are actively exploiting it in the wild (listed by CISA on November 7, 2024). The chance it is exploited in the next 30 days is estimated at 91.7% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Nov 28, 2024.
Official description
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Palo Alto Networks | Expedition | 1.2 – before 1.2.92 |
Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:D/RE:M/U:Red