CVE-2024-9465
CRITICAL KEV NUCLEIPaloaltonetworks Expedition < 1.2.96 - SQL Injection
Title source: ruleDescription
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
Exploits (5)
Nuclei Templates (1)
Palo Alto Expedition - SQL Injection
HIGHVERIFIEDby DhiyaneshDK
Shodan:
http.favicon.hash:1499876150
References (3)
Scores
CVSS v3
9.1
EPSS
0.9429
EPSS Percentile
99.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Details
CISA KEV
2024-11-14
VulnCheck KEV
2024-11-12
InTheWild.io
2024-11-14
ENISA EUVD
EUVD-2024-49957
CWE
CWE-89
Status
published
Products (1)
paloaltonetworks/expedition
1.2.0 - 1.2.96
Published
Oct 09, 2024
KEV Added
Nov 14, 2024
Tracked Since
Feb 18, 2026