Security News > 2024 > July > Palo Alto Networks Patches Critical Flaw in Expedition Migration Tool

Palo Alto Networks has released security updates to address five security flaws impacting its products, including a critical bug that could lead to an authentication bypass.

Cataloged as CVE-2024-5910, the vulnerability has been described as a case of missing authentication in its Expedition migration tool that could lead to an admin account takeover.

"Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition," the company said in an advisory.

The flaw impacts all versions of Expedition prior to version 1.2.92, which remediates the problem.

As workarounds, Palo Alto Networks is recommending that network access to Expedition is restricted to authorized users, hosts, or networks.

Also fixed by the American cybersecurity firm is a newly disclosed flaw in the RADIUS protocol called BlastRADIUS that could allow a bad actor with capabilities to perform an adversary-in-the-middle attack between Palo Alto Networks PAN-OS firewall and a RADIUS server to sidestep authentication.

News URL

https://thehackernews.com/2024/07/palo-alto-networks-patches-critical.html