CyberCVE

CVE-2024-9466

Expedition: Cleartext Storage of Information Leads to Firewall Admin Credential Disclosure

Severity
High 8.2
CVSS 4.0
Exploited
Not listed
EPSS
0.129
95.9th percentile
Discovered by
Third party
Published by the vendor
Published
Oct 9, 2024
Assigned by palo_alto

Description

A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials.

Weakness: CWE-532

Affected products

Vendor Product Category Matched by
Palo Alto Networks Expedition Network & Security Management cna-assigner
Vendor-reported affected versions (2)
  • Palo Alto Networks · Expedition
  • paloaltonetworks · expedition

Credit

Zach Hanley (@hacks_zach) of Horizon3.ai

Vendor remediation

The fixes for all listed issues are available in Expedition 1.2.96, and all later Expedition versions. The affected cleartext file will be removed automatically during the upgrade. All Expedition usernames, passwords, and API keys should be rotated after upgrading to the fixed version of Expedition. All firewall usernames, passwords, and API keys processed by Expedition should be rotated after updating.

References