CVE-2025-0104
A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.
- Score
- CVSS 4.0 7.0 High
- Status
- Analyzed - psirt@paloaltonetworks.com
- Published
- 2025-01-11
- Last modified
- 2025-01-13
- Weaknesses
- CWE-79
Affected products
- Cloud Ngfw (Palo Alto Networks)
- Expedition (Palo Alto Networks)
- Pan-os (Palo Alto Networks)
- Panorama (Palo Alto Networks)
- Prisma Access (Palo Alto Networks)
- Expedition (Paloaltonetworks)
References
- https://security.paloaltonetworks.com/PAN-SA-2025-0001
