CVE-2024-9467 HIGH

CVE-2024-9467: Expedition: Reflected Cross-Site Scripting Vulnerability Leads to Expedition Session Disclosure

Vendor Palo Alto Networks

Product Expedition

Weakness CWE-79 · XSS

Published October 9, 2024

Last update October 18, 2024

View on NVD All CVEs

CVSS base score

7.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber

What the vulnerability does

01Description

A reflected XSS vulnerability in Palo Alto Networks Expedition enables execution of malicious JavaScript in the context of an authenticated Expedition user's browser if that user clicks on a malicious link, allowing phishing attacks that could lead to Expedition browser session theft.

Key dates

02Disclosure timeline

October 9, 2024 CVE published

October 18, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-9467 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-49311 WordPress The Events Calendar Countdown Addon plugin <= 1.4.9 - Cross Site Scripting (XSS) Vulnerability CVE-2025-68031 WordPress افزونه پیامک حرفه ای فراز اس ام اس plugin <= 2.7.3 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2022-2114 Data Tables Generator by Supsystic < 1.10.20 - Admin+ Stored Cross-Site Scripting CVE-2025-48236 WordPress bunny.net plugin <= 2.3.0 - Cross Site Scripting (XSS) Vulnerability CVE-2022-0388 Interactive Medical Drawing of Human Body < 2.6 - Admin+ Stored XSS