KEVIntel
Back to KEVs
9.2
CVSS
Critical

CVE-2024-9465

PUBLISHED

Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

Exploited in the wild PoC available Remote Low complexity No user interaction
Vendor
Palo Alto Networks
Product
Expedition
Published
Oct 09, 2024
EPSS
—

Description

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.

cisa nuclei_scanner edge nessus_scanner

CVSS scores

CVSS v4.0 9.2 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber

Exploitation status

Exploited in the wild

Recorded 2024-11-14 00:00:00 UTC · Source

Proof of concept available

Recorded 2024-10-09 16:22:05 UTC · Source

SSVC decision points

Exploitation
active
Automatable
Yes
Technical impact
total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
CISA Nov 14, 2024

Scanner integrations

Scanner Reference Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9465.yaml Apr 25, 2025

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

horizon3ai/CVE-2024-9465

github · Created 2024-10-09 16:22:05 UTC · 29 stars

Proof of Concept Exploit for CVE-2024-9465

Timeline

  • CVE ID Reserved

  • Proof of Concept Exploit Available

  • CVE Published to Public

  • Added to KEVIntel

  • Detected by Nuclei