[Security] Adaptative Authentication Rules triggered by “Refresh my rights”
[Security] XSS in upgradeSession / forceUpgrade pages
downloadSamlMetadata missing from packages in 2.20.0
CDA request for id is not valid
“This application is not known” when trying to access a federation application with empty RelayState
SAML regression in 2.20.0
Internal error when captcha rule isn’t validated
[Security] Adaptative Authentication Rules triggered by “Refresh my rights”
[Security] XSS in upgradeSession / forceUpgrade pages
downloadSamlMetadata missing from packages in 2.20.0
CDA request for id is not valid
“This application is not known” when trying to access a federation application with empty RelayState
SAML regression in 2.20.0
Internal error when captcha rule isn’t validated
[Security] Adaptative Authentication Rules triggered by “Refresh my rights”
[Security] XSS in upgradeSession / forceUpgrade pages
downloadSamlMetadata missing from packages in 2.20.0
CDA request for id is not valid
“This application is not known” when trying to access a federation application with empty RelayState
SAML regression in 2.20.0
Internal error when captcha rule isn’t validated
[Security] Adaptative Authentication Rules triggered by “Refresh my rights”
[Security] XSS in upgradeSession / forceUpgrade pages
downloadSamlMetadata missing from packages in 2.20.0
CDA request for id is not valid
“This application is not known” when trying to access a federation application with empty RelayState
SAML regression in 2.20.0
Internal error when captcha rule isn’t validated
[Security] Adaptative Authentication Rules triggered by “Refresh my rights”
[Security] XSS in upgradeSession / forceUpgrade pages
downloadSamlMetadata missing from packages in 2.20.0
CDA request for id is not valid
“This application is not known” when trying to access a federation application with empty RelayState
SAML regression in 2.20.0
Internal error when captcha rule isn’t validated
Several vulnerabilities were discovered in NSS, a set of cryptographic
libraries, which may result in denial of service or potentially the
execution of arbitary code.
What is the Vulnerability?CISA has added CVE-2024-5910, a missing authentication vulnerability in Palo Alto Networks Expedition to its known exploited vulnerability (KEV) list. Expedition is a migration tool aiding in configuration migration, tuning, and enrichment from one of the supported vendors to Palo Alto Networks. Successful exploitation of CVE-2024-5910 can lead to an admin account takeover. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue. What is the recommended Mitigation?Palo Alto Networks has released security updates to address the vulnerability. This issue is fixed in Expedition 1.2.92 and all later versions. https://security.paloaltonetworks.com/CVE-2024-5910 What is FortiGuard Coverage?FortiGuard recommends users to apply the fix provided by the vendor and follow any mitigation steps provided. FortiGuard IPS protection is available, and Fortinet customers remain protected through it. Intrusion Prevention | FortiGuard LabsThe FortiGuard Incident Response team can be engaged to help with any suspected compromise.
