An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. This vulnerability also enables attackers to create and read arbitrary files on the Expedition system.
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:AmberPalo Alto Networks Expedition
APPPaloaltonetworks< 1.2.101
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
Related vulnerabilities
CVE-2024-9463CRITICAL9.9⚠ KEVPL ✓ten sam produkt
Command injection w Palo Alto Networks Expedition — nieautoryzowane RCE jako root
CVE-2024-9465CRITICAL9.2⚠ KEVPL ✓ten sam produkt
SQL Injection w Palo Alto Networks Expedition — dostęp do danych i plików
CVE-2024-5910CRITICAL9.3⚠ KEVPL ✓ten sam produkt
Brak uwierzytelnienia w Palo Alto Networks Expedition — przejęcie konta admina
CVE-2024-9464CRITICAL9.3PL ✓ten sam produkt
OS command injection w Palo Alto Networks Expedition umożliwiający RCE jako root
CVE-2018-10143CRITICAL9.8ten sam produkt
The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker wit...