CyberCVE

CVE-2024-9467

Expedition: Reflected Cross-Site Scripting Vulnerability Leads to Expedition Session Disclosure

Severity
High 7
CVSS 4.0
Exploited
Not listed
EPSS
0.006
46.8th percentile
Discovered by
Third party
Published by the vendor
Published
Oct 9, 2024
Assigned by palo_alto

Description

A reflected XSS vulnerability in Palo Alto Networks Expedition enables execution of malicious JavaScript in the context of an authenticated Expedition user's browser if that user clicks on a malicious link, allowing phishing attacks that could lead to Expedition browser session theft.

Weakness: CWE-79

Affected products

Vendor Product Category Matched by
Palo Alto Networks Expedition Network & Security Management cna-assigner
Vendor-reported affected versions (1)
  • Palo Alto Networks · Expedition

Credit

Enrique Castillo of Palo Alto Networks

Vendor remediation

The fixes for all listed issues are available in Expedition 1.2.96, and all later Expedition versions. All Expedition usernames, passwords, and API keys should be rotated after upgrading to the fixed version of Expedition. All firewall usernames, passwords, and API keys processed by Expedition should be rotated after updating.

References