CVE-2024-9466
A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials.
- Affected products
- Palo Alto Networks Expedition
- Paloaltonetworks Expedition
- < 1.2.96
- CVSS 4.0
- 8.2 HIGH
- CVSS 3.1
- 6.5 MEDIUM
- EPSS
- 13.5% (96th percentile)
- Weakness
- CWE-532, CWE-312
- NVD status
- Modified
- Published
- 2024-10-09
- Attack patterns
- CAPEC-37
Fix
The fixes for all listed issues are available in Expedition 1.2.96, and all later Expedition versions. The affected cleartext file will be removed automatically during the upgrade. All Expedition usernames, passwords, and API keys should be rotated after upgrading to the fixed version of Expedition. All firewall usernames, passwords, and API keys processed by Expedition should be rotated after updating.
Workaround
Ensure networks access to Expedition is restricted to authorized users, hosts, or networks.
2 known exploits for CVE-2024-9466
Proof-of-concept code and exploit modules indexed by Sploitus