CVE-2024-9465
Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure
Description
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
Weakness: CWE-89
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Palo Alto Networks | Expedition | Network & Security Management | cna-assigner |
Vendor-reported affected versions (1)
- Palo Alto Networks · Expedition
Credit
Zach Hanley (@hacks_zach) of Horizon3.ai
Vendor remediation
The fixes for all listed issues are available in Expedition 1.2.96, and all later Expedition versions. All Expedition usernames, passwords, and API keys should be rotated after upgrading to the fixed version of Expedition. All firewall usernames, passwords, and API keys processed by Expedition should be rotated after updating.