Expedition: Missing Authentication Leads to Admin Account Takeover
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 1.2.92
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Palo Alto Networks Expedition, a tool used to migrate, tune, and enrich firewall configurations, is affected by this vulnerability. An attacker with network access to Expedition could take over an administrator account and gain access to configuration secrets, credentials, and other data imported into the tool.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Palo Alto Networks Expedition
From 1.2 · fixed in 1.2.92
References 1
security.paloaltonetworks.com
Questions about CVE-2024-5910
What does this mean?
A missing authentication check in Expedition can let an attacker take over an Expedition admin account. Configuration secrets and credentials imported into Expedition would then be at risk.Source: security.paloaltonetworks.com
Am I affected, and how do I check?
Expedition version 1.2 before 1.2.92 is affected. To check a installation, look at the Expedition version shown in the product.Source: security.paloaltonetworks.com
What should I do about it?
Upgrade Expedition to 1.2.92 or any later version, which contains the fix.Source: security.paloaltonetworks.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-11-07, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data