Skip to content
OpenAdvisories
High · 7.0 CVE-2025-0104 EUVD-2025-1501GHSA-qfq8-mv2q-hvwp

Expedition: Cross-Site Scripting (XSS) Vulnerability

Published Jan 11, 2025 · Updated Jan 13, 2025 · Assigned by palo_alto

Vendor: Palo Alto Networks Product: Cloud NGFW Product: Expedition Product: PAN-OS Product: Panorama Product: Prisma Access Category: Network devices

Description

A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.

Affected products

VendorProductAffectedFixed
Palo Alto Networks Cloud NGFW — All
Palo Alto Networks Expedition 1 – < 1.2.100 1.2.100
Palo Alto Networks Panorama — All
Palo Alto Networks PAN-OS — All
Palo Alto Networks Prisma Access — All

Advisories 1

References