Log in Start free

Vulnerability · Published Jan 11, 2025 · Assigned by palo_alto

CVE-2025-0104Expedition: Cross-Site Scripting (XSS) Vulnerability

High 7.0

In plain English

A high-severity cross-site scripting in Cloud NGFW from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 4.0)7.0High
Exploit odds (30 days)0.4%top 71.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.

Affected products (as reported)

VendorProductVersions
Palo Alto Networks Cloud NGFW see references
Palo Alto Networks Expedition 1 – before 1.2.100
Palo Alto Networks Panorama see references
Palo Alto Networks PAN-OS see references
Palo Alto Networks Prisma Access see references

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber

References