Actively exploited in the wild
Palo Alto Networks Expedition SQL Injection Vulnerability
Palo Alto Networks - Expedition · Listed in the CISA KEV since 2024-11-14. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-9465
CriticalCVSS 9.1KEVSummary
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal database contents, such as password hashes, usernames, device configurations, and API keys. Attackers can also create and read arbitrary files on the system.
Risk Assessment
An attacker can obtain sensitive credentials and configuration data, potentially leading to further attacks on the infrastructure.
Recommendation
Immediately update Expedition to a patched version as indicated by the vendor.
Other vulnerabilities in Palo Alto Networks Expedition
See all- CVE-2024-9463HighActively exploited
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
- CVE-2024-5910CriticalActively exploited
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access. Configuration secrets, credentials, and other data imported into Expedition are at risk.
Original NVD description (English source)
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS