Palo Alto Networks Expedition vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Palo Alto Networks Expedition: 3 record(s), with affected versions and fixes.
CVE-2024-9465
Critical · 9.1
KEV Urgent · 73 Public exploit CWE-89 Oct 9, 2024
Palo Alto Networks Expedition SQL Injection Vulnerability
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
CVE-2024-9463
High · 7.5
KEV High · 69 Public exploit CWE-78 Oct 9, 2024
Palo Alto Networks Expedition OS Command Injection Vulnerability
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
CVE-2024-5910
Critical · 9.8
KEV Urgent · 83 Public exploit CWE-306 Jul 10, 2024
Palo Alto Networks Expedition Missing Authentication Vulnerability
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.
Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.