Skip to content
OpenAdvisories
High WID-SEC-2025-0037 5 CVEs

PaloAlto Networks Expedition: Mehrere Schwachstellen

Published Jan 8, 2025 · Updated Jan 8, 2025 · de-DE

Vendor: Palo Alto Networks Product: Expedition

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PaloAlto Networks Expedition ausnutzen, um Daten zu manipulieren, Informationen offenzulegen, einen Cross Site Scripting Angriff durchzuführen, oder Befehle auszuführen.

Product

Palo Alto Expedition ist eine Next-Generation-Firewall (NGFW)-Plattform

Vulnerabilities 5

  • Critical 9.2
    CVE-2025-0103

    Expedition: SQL Injection Vulnerability

    An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. This vulnerability also enables attackers…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • High 7.7
    CVE-2025-0107 Scanner template EPSS 78%

    Expedition: OS Command Injection Vulnerability

    An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configuration…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • High 7.0
    CVE-2025-0104

    Expedition: Cross-Site Scripting (XSS) Vulnerability

    A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that a…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 6.9
    CVE-2025-0105 EPSS 13%

    Expedition: Arbitrary File Deletion Vulnerability

    An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-data user on the host filesystem.

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 6.9
    CVE-2025-0106

    Expedition: Wildcard Expansion Vulnerability

    A wildcard expansion vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to enumerate files on the host filesystem.

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices

Revision history

  1. #1

    Initiale Fassung

References