CVE-2024-5910

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.

Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Jul 10, 2024
Last modified
Jun 17, 2026
Added to CISA KEV
Nov 7, 2024
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-59114.9An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with accessCVE-2024-59126.8An improper file signature check in Palo Alto Networks Cortex XDR agent may allow an attacker to bypass the Cortex XDR agent's executable blCVE-2024-59136.8An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the phyCVE-2024-59149.8A command injection issue in Palo Alto Networks Cortex XSOAR CommonScripts Pack allows an unauthenticated attacker to execute arbitrary commCVE-2024-59157.8A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute proCVE-2024-59164.4An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally discloseCVE-2024-59174.9A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative CVE-2024-59184.3An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted cCVE-2024-59196.5A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to eCVE-2024-59204.8A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator CVE-2024-59218.8An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect apCVE-2024-59226.4The Scylla lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode
CVE-2024-5910: Critical severity, CVSS 9.8 | Vulnix