CVE-2024-9467
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Summary
A reflected XSS vulnerability in Palo Alto Networks Expedition enables execution of malicious JavaScript in the context of an authenticated Expedition user's browser if that user clicks on a malicious link. This vulnerability affects Palo Alto Networks Expedition versions 1.2.0 up to, but not including, 1.2.96.
Impact
This vulnerability could allow attackers to conduct phishing attacks that may lead to Expedition browser session theft. The impact is primarily on the confidentiality and integrity of user data, with potential for attackers to gain unauthorized access to sensitive information or perform actions on behalf of the authenticated user. The CVSS v3.1 base score is 6.1 (Medium severity), while the CVSS v4.0 base score is 7.0 (High severity), indicating a significant risk.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Palo Alto Networks has released security updates to address this vulnerability. The patch details can be found at https://security.paloaltonetworks.com/PAN-SA-2024-0010.
Mitigation
1. Update Palo Alto Networks Expedition to version 1.2.96 or later as soon as possible. 2. Implement strong input validation and output encoding practices to prevent XSS attacks. 3. Educate users about the risks of clicking on untrusted links, especially those received through email or other messaging platforms. 4. Consider implementing Content Security Policy (CSP) headers to mitigate the risk of XSS attacks. 5. Regularly monitor and audit the Expedition application for any suspicious activities or unauthorized access attempts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Amber
Timeline
NVD published the first details for CVE-2024-9467
A CVSS base score of 7 has been assigned.
Feedly found the first article mentioning CVE-2024-9467. See article
Feedly estimated the CVSS score as MEDIUM
EPSS Score was set to: 0.04% (Percentile: 9.7%)
CVE-2024-9467 is a reflected XSS vulnerability with a CVSS score of 7.0, allowing for the execution of malicious JavaScript, which could lead to phishing attacks or session theft. The details provided do not specify whether it is being exploited in the wild, nor do they mention any proof-of-concept exploits, mitigations, detections, or patches available. Additionally, there is no information regarding potential downstream impacts to other third-party vendors or technology. See article
Detection for the vulnerability has been added to Qualys (731836)
A CVSS base score of 6.1 has been assigned.