Junglewise Threat Intelligence

CVE-2024-5910: Palo Alto Networks Expedition Missing Authentication Vulnerability

CVE-2024-5910 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2024-11-07

Technologies: Palo Alto Networks Expedition. Vendors: Palo Alto Networks, Palo Alto Networks.

Executive brief

Palo Alto Networks Expedition contains a missing authentication vulnerability for a critical function. This allows unauthenticated attackers with network access to take over an Expedition admin account, potentially exposing configuration secrets, credentials, and other imported data.

Affected products

  • Palo Alto Networks Expedition 1.2.0 to 1.2.91

Timeline

  • 2024-07-10: disclosed: Initial NVD publication date
  • 2024-11-07: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2024-11-07: exploited: Reported as exploited in the wild

Related threats