CVE-2024-5910

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.

Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
Palo Alto NetworksExpedition>= 1.2, < 1.2.92
paloaltonetworksexpedition>= 1.2, < 1.2.92

References

Timeline

Published
Jul 10, 2024
Last modified
Jun 17, 2026
Added to CISA KEV
Nov 7, 2024
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-59114.9An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with accessCVE-2024-59126.8An improper file signature check in Palo Alto Networks Cortex XDR agent may allow an attacker to bypass the Cortex XDR agent's executable blCVE-2024-59136.8An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the phyCVE-2024-59149.8A command injection issue in Palo Alto Networks Cortex XSOAR CommonScripts Pack allows an unauthenticated attacker to execute arbitrary commCVE-2024-59157.8A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute proCVE-2024-59164.4An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally discloseCVE-2024-59174.9A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative CVE-2024-59184.3An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted cCVE-2024-59196.5A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to eCVE-2024-59204.8A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator CVE-2024-59218.8An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect apCVE-2024-59226.4The Scylla lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode
CVE-2024-5910: Critical severity, CVSS 9.8 | Vulnix