Skip to content
OpenAdvisories
High 2 exploited CVEs NCSC-2024-0405 5 CVEs

Kwetsbaarheden verholpen in Palo Alto Expedition

Published Oct 10, 2024 · Updated Oct 10, 2024 · nl

Vendor: Palo Alto Networks Product: Expedition

Summary

Palo Alto heeft kwetsbaarheden verholpen in Expedition.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om op afstand, zonder voorafgaande authenticatie, willekeurige code uit te voeren op het systeem waarop Expedition draait en zo mogelijk aan logingegevens en API-keys te komen.

Expedition is een migratietool om de configuratie van firewalls van derde partijen te converteren en importeren naar systemen die draaien op PAN-OS.

Expedition is onder normale omstandigheden niet actief op een firewall van Palo Alto, maar dient apart opgestart te worden voor migratiedoeleinden.

Oplossingen
Palo Alto heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 5

  • Critical 9.9
    CVE-2024-9463 Exploited Public exploit Scanner template EPSS 99%

    Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

    An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys…

    Palo Alto Networks Expedition Network devices
    KEV Nov 14, 2024
  • Critical 9.2
    CVE-2024-9465 Exploited Public exploit Scanner template EPSS 100%

    Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

    An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and…

    Palo Alto Networks Expedition Network devices
    KEV Nov 14, 2024
  • Critical 9.3
    CVE-2024-9464 Public exploit EPSS 83%

    Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure

    An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys o…

    Palo Alto Networks Expedition Network devices
  • High 8.2
    CVE-2024-9466 Public exploit EPSS 14%

    Expedition: Cleartext Storage of Information Leads to Firewall Admin Credential Disclosure

    A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials.

    Palo Alto Networks Expedition Network devices
  • High 7.0
    CVE-2024-9467

    Expedition: Reflected Cross-Site Scripting Vulnerability Leads to Expedition Session Disclosure

    A reflected XSS vulnerability in Palo Alto Networks Expedition enables execution of malicious JavaScript in the context of an authenticated Expedition user's browser if that user clicks on a malicious link, allowing phishing attacks that could lead to Expedit…

    Palo Alto Networks Expedition Network devices

Revision history

  1. #0

    Initiele versie

References