⚠ Actively exploited
Added to CISA KEV on 2024-11-07. Federal agencies required to patch by 2024-11-28. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable..
CVE-2024-5910 — Missing Authentication for Critical Function in Palo Alto Networks Expedition
Severity
9.3CRITICALNVD
EPSS
91.0%
top 0.36%
CISA KEV
KEV
Added 2024-11-07
Due 2024-11-28
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedJul 10
KEV addedNov 7
KEV dueNov 28
Latest updateApr 6
CISA Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.
Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Affected Packages3 packages
🔴Vulnerability Details
3GHSA▶
GHSA-px3f-fc5j-2fqv: Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with ne↗2024-07-10
💥Exploits & PoCs
3🔍Detection Rules
1Suricata▶
ET WEB_SPECIFIC_APPS Palo Alto Expedition Unauthenticated Admin Password Reset (CVE-2024-5910)↗2024-10-10