cvelistv5 - cve-2025-0104

cve-2025-0104

Vulnerability from cvelistv5

Published

2025-01-11 03:00

Modified

2025-01-13 19:51

Severity ?

7.0 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber

EPSS score ?

0.04% (0.11988)

Summary

A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.

References

▼	URL	Tags
	psirt@paloaltonetworks.com	https://security.paloaltonetworks.com/PAN-SA-2025-0001

Impacted products

Vendor

Product

Version

▼

Palo Alto Networks

Cloud NGFW

Patch: All

Palo Alto Networks	Expedition	Version: 1 < 1.2.100
Palo Alto Networks	Panorama	Patch: All
Palo Alto Networks	PAN-OS	Patch: All
Palo Alto Networks	Prisma Access	Patch: All

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-0104",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-01-13T19:51:18.710027Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-01-13T19:51:27.183Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Cloud NGFW",
               vendor: "Palo Alto Networks",
               versions: [
                  {
                     status: "unaffected",
                     version: "All",
                     versionType: "custom",
                  },
               ],
            },
            {
               defaultStatus: "unaffected",
               product: "Expedition",
               vendor: "Palo Alto Networks",
               versions: [
                  {
                     changes: [
                        {
                           at: "1.2.100",
                           status: "unaffected",
                        },
                     ],
                     lessThan: "1.2.100",
                     status: "affected",
                     version: "1",
                     versionType: "custom",
                  },
               ],
            },
            {
               defaultStatus: "unaffected",
               product: "Panorama",
               vendor: "Palo Alto Networks",
               versions: [
                  {
                     status: "unaffected",
                     version: "All",
                     versionType: "custom",
                  },
               ],
            },
            {
               defaultStatus: "unaffected",
               product: "PAN-OS",
               vendor: "Palo Alto Networks",
               versions: [
                  {
                     status: "unaffected",
                     version: "All",
                     versionType: "custom",
                  },
               ],
            },
            {
               defaultStatus: "unaffected",
               product: "Prisma Access",
               vendor: "Palo Alto Networks",
               versions: [
                  {
                     status: "unaffected",
                     version: "All",
                     versionType: "custom",
                  },
               ],
            },
         ],
         configurations: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "No special configuration is required to be affected by this issue.",
                  },
               ],
               value: "No special configuration is required to be affected by this issue.",
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Mesut Cetin of RedTeamer IT Security",
            },
            {
               lang: "en",
               type: "finder",
               value: "Advanced Research Team, CrowdStrike",
            },
         ],
         datePublic: "2025-01-08T17:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.",
                  },
               ],
               value: "A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.",
            },
         ],
         exploits: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Palo Alto Networks is not aware of any malicious exploitation of this issue.",
                  },
               ],
               value: "Palo Alto Networks is not aware of any malicious exploitation of this issue.",
            },
         ],
         impacts: [
            {
               capecId: "CAPEC-63",
               descriptions: [
                  {
                     lang: "en",
                     value: "CAPEC-63 Cross-Site Scripting (XSS)",
                  },
               ],
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  Automatable: "NO",
                  Recovery: "USER",
                  Safety: "NOT_DEFINED",
                  attackComplexity: "LOW",
                  attackRequirements: "NONE",
                  attackVector: "NETWORK",
                  baseScore: 7,
                  baseSeverity: "HIGH",
                  privilegesRequired: "NONE",
                  providerUrgency: "AMBER",
                  subAvailabilityImpact: "NONE",
                  subConfidentialityImpact: "NONE",
                  subIntegrityImpact: "NONE",
                  userInteraction: "ACTIVE",
                  valueDensity: "CONCENTRATED",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber",
                  version: "4.0",
                  vulnAvailabilityImpact: "NONE",
                  vulnConfidentialityImpact: "HIGH",
                  vulnIntegrityImpact: "LOW",
                  vulnerabilityResponseEffort: "HIGH",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-79",
                     description: "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-01-11T03:00:40.318Z",
            orgId: "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
            shortName: "palo_alto",
         },
         references: [
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.paloaltonetworks.com/PAN-SA-2025-0001",
            },
         ],
         solutions: [
            {
               lang: "eng",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "This issue is fixed in Expedition 1.2.100 and all later versions* of Expedition.<br><br>* Expedition <a target=\"_blank\" rel=\"nofollow\" href=\"https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642\">reached its End of Life (EoL) date</a> and is no longer supported. We added these fixes prior to the EoL date and we do not plan to make any additional updates or security fixes. Please use the suggested alternatives listed in <a target=\"_blank\" rel=\"nofollow\" href=\"https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642\">the Expedition End of Life Announcement</a>.",
                  },
               ],
               value: "This issue is fixed in Expedition 1.2.100 and all later versions* of Expedition.\n\n* Expedition  reached its End of Life (EoL) date https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642  and is no longer supported. We added these fixes prior to the EoL date and we do not plan to make any additional updates or security fixes. Please use the suggested alternatives listed in  the Expedition End of Life Announcement https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642 .",
            },
         ],
         source: {
            discovery: "EXTERNAL",
         },
         tags: [
            "unsupported-when-assigned",
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-01-08T17:00:00.000Z",
               value: "Initial publication",
            },
         ],
         title: "Expedition: Cross-Site Scripting (XSS) Vulnerability",
         workarounds: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Ensure that all network access to Expedition is restricted to only authorized users, hosts, and networks. If you are not actively using Expedition, make sure that your Expedition software is shut down.",
                  },
               ],
               value: "Ensure that all network access to Expedition is restricted to only authorized users, hosts, and networks. If you are not actively using Expedition, make sure that your Expedition software is shut down.",
            },
         ],
         x_generator: {
            engine: "Vulnogram 0.2.0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
      assignerShortName: "palo_alto",
      cveId: "CVE-2025-0104",
      datePublished: "2025-01-11T03:00:40.318Z",
      dateReserved: "2024-12-20T23:23:02.943Z",
      dateUpdated: "2025-01-13T19:51:27.183Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2025-0104\",\"sourceIdentifier\":\"psirt@paloaltonetworks.com\",\"published\":\"2025-01-11T03:15:22.183\",\"lastModified\":\"2025-01-11T03:15:22.183\",\"vulnStatus\":\"Received\",\"cveTags\":[{\"sourceIdentifier\":\"psirt@paloaltonetworks.com\",\"tags\":[\"unsupported-when-assigned\"]}],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"psirt@paloaltonetworks.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Amber\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"ACTIVE\",\"vulnerableSystemConfidentiality\":\"HIGH\",\"vulnerableSystemIntegrity\":\"LOW\",\"vulnerableSystemAvailability\":\"NONE\",\"subsequentSystemConfidentiality\":\"NONE\",\"subsequentSystemIntegrity\":\"NONE\",\"subsequentSystemAvailability\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirements\":\"NOT_DEFINED\",\"integrityRequirements\":\"NOT_DEFINED\",\"availabilityRequirements\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnerableSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedVulnerableSystemIntegrity\":\"NOT_DEFINED\",\"modifiedVulnerableSystemAvailability\":\"NOT_DEFINED\",\"modifiedSubsequentSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedSubsequentSystemIntegrity\":\"NOT_DEFINED\",\"modifiedSubsequentSystemAvailability\":\"NOT_DEFINED\",\"safety\":\"NOT_DEFINED\",\"automatable\":\"NO\",\"recovery\":\"USER\",\"valueDensity\":\"CONCENTRATED\",\"vulnerabilityResponseEffort\":\"HIGH\",\"providerUrgency\":\"AMBER\"}}]},\"weaknesses\":[{\"source\":\"psirt@paloaltonetworks.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://security.paloaltonetworks.com/PAN-SA-2025-0001\",\"source\":\"psirt@paloaltonetworks.com\"}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-0104\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-13T19:51:18.710027Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-13T19:51:23.206Z\"}}], \"cna\": {\"tags\": [\"unsupported-when-assigned\"], \"title\": \"Expedition: Cross-Site Scripting (XSS) Vulnerability\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Mesut Cetin of RedTeamer IT Security\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Advanced Research Team, CrowdStrike\"}], \"impacts\": [{\"capecId\": \"CAPEC-63\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-63 Cross-Site Scripting (XSS)\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"USER\", \"baseScore\": 7, \"Automatable\": \"NO\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"CONCENTRATED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber\", \"providerUrgency\": \"AMBER\", \"userInteraction\": \"ACTIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Palo Alto Networks\", \"product\": \"Cloud NGFW\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"All\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Palo Alto Networks\", \"product\": \"Expedition\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"1.2.100\", \"status\": \"unaffected\"}], \"version\": \"1\", \"lessThan\": \"1.2.100\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Palo Alto Networks\", \"product\": \"Panorama\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"All\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Palo Alto Networks\", \"product\": \"PAN-OS\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"All\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Palo Alto Networks\", \"product\": \"Prisma Access\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"All\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"Palo Alto Networks is not aware of any malicious exploitation of this issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Palo Alto Networks is not aware of any malicious exploitation of this issue.\", \"base64\": false}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-01-08T17:00:00.000Z\", \"value\": \"Initial publication\"}], \"solutions\": [{\"lang\": \"eng\", \"value\": \"This issue is fixed in Expedition 1.2.100 and all later versions* of Expedition.\\n\\n* Expedition  reached its End of Life (EoL) date https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642  and is no longer supported. We added these fixes prior to the EoL date and we do not plan to make any additional updates or security fixes. Please use the suggested alternatives listed in  the Expedition End of Life Announcement https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642 .\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"This issue is fixed in Expedition 1.2.100 and all later versions* of Expedition.<br><br>* Expedition <a target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642\\\">reached its End of Life (EoL) date</a> and is no longer supported. We added these fixes prior to the EoL date and we do not plan to make any additional updates or security fixes. Please use the suggested alternatives listed in <a target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642\\\">the Expedition End of Life Announcement</a>.\", \"base64\": false}]}], \"datePublic\": \"2025-01-08T17:00:00.000Z\", \"references\": [{\"url\": \"https://security.paloaltonetworks.com/PAN-SA-2025-0001\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Ensure that all network access to Expedition is restricted to only authorized users, hosts, and networks. If you are not actively using Expedition, make sure that your Expedition software is shut down.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Ensure that all network access to Expedition is restricted to only authorized users, hosts, and networks. If you are not actively using Expedition, make sure that your Expedition software is shut down.\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user\\u2019s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user\\u2019s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"No special configuration is required to be affected by this issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"No special configuration is required to be affected by this issue.\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"d6c1279f-00f6-4ef7-9217-f89ffe703ec0\", \"shortName\": \"palo_alto\", \"dateUpdated\": \"2025-01-11T03:00:40.318Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2025-0104\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-13T19:51:27.183Z\", \"dateReserved\": \"2024-12-20T23:23:02.943Z\", \"assignerOrgId\": \"d6c1279f-00f6-4ef7-9217-f89ffe703ec0\", \"datePublished\": \"2025-01-11T03:00:40.318Z\", \"assignerShortName\": \"palo_alto\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}

wid-sec-w-2025-0037

Vulnerability from csaf_certbund

Published

2025-01-08 23:00

Modified

2025-01-08 23:00

Summary

PaloAlto Networks Expedition: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Palo Alto Expedition ist eine Next-Generation-Firewall (NGFW)-Plattform

Angriff

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PaloAlto Networks Expedition ausnutzen, um Daten zu manipulieren, Informationen offenzulegen, einen Cross Site Scripting Angriff durchzuführen, oder Befehle auszuführen.

Betroffene Betriebssysteme

- Sonstiges

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         text: "hoch",
      },
      category: "csaf_base",
      csaf_version: "2.0",
      distribution: {
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "de-DE",
      notes: [
         {
            category: "legal_disclaimer",
            text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.",
         },
         {
            category: "description",
            text: "Palo Alto Expedition ist eine Next-Generation-Firewall (NGFW)-Plattform",
            title: "Produktbeschreibung",
         },
         {
            category: "summary",
            text: "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PaloAlto Networks Expedition ausnutzen, um Daten zu manipulieren, Informationen offenzulegen, einen Cross Site Scripting Angriff durchzuführen, oder Befehle auszuführen.",
            title: "Angriff",
         },
         {
            category: "general",
            text: "- Sonstiges",
            title: "Betroffene Betriebssysteme",
         },
      ],
      publisher: {
         category: "other",
         contact_details: "csaf-provider@cert-bund.de",
         name: "Bundesamt für Sicherheit in der Informationstechnik",
         namespace: "https://www.bsi.bund.de",
      },
      references: [
         {
            category: "self",
            summary: "WID-SEC-W-2025-0037 - CSAF Version",
            url: "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0037.json",
         },
         {
            category: "self",
            summary: "WID-SEC-2025-0037 - Portal Version",
            url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0037",
         },
         {
            category: "external",
            summary: "Palo Alto Networks Security Advisories vom 2025-01-08",
            url: "https://security.paloaltonetworks.com/PAN-SA-2025-0001",
         },
      ],
      source_lang: "en-US",
      title: "PaloAlto Networks Expedition: Mehrere Schwachstellen",
      tracking: {
         current_release_date: "2025-01-08T23:00:00.000+00:00",
         generator: {
            date: "2025-01-09T12:42:10.957+00:00",
            engine: {
               name: "BSI-WID",
               version: "1.3.10",
            },
         },
         id: "WID-SEC-W-2025-0037",
         initial_release_date: "2025-01-08T23:00:00.000+00:00",
         revision_history: [
            {
               date: "2025-01-08T23:00:00.000+00:00",
               number: "1",
               summary: "Initiale Fassung",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version_range",
                        name: "<1.2.101",
                        product: {
                           name: "PaloAlto Networks Expedition <1.2.101",
                           product_id: "T040073",
                        },
                     },
                     {
                        category: "product_version",
                        name: "1.2.101",
                        product: {
                           name: "PaloAlto Networks Expedition 1.2.101",
                           product_id: "T040073-fixed",
                           product_identification_helper: {
                              cpe: "cpe:/a:paloaltonetworks:expedition:1.2.101",
                           },
                        },
                     },
                  ],
                  category: "product_name",
                  name: "Expedition",
               },
            ],
            category: "vendor",
            name: "PaloAlto Networks",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2025-0103",
         notes: [
            {
               category: "description",
               text: "Es existiert eine Schwachstelle in PaloAlto Networks Expedition. Es handelt sich um eine SQL-Injection-Schwachstelle. Ein entfernter, authentifizierter Angreifer kann dadurch kritische Informationen wie Passwort-Hashes, Benutzernamen, Gerätekonfigurationen und API-Keys ausspionieren und manipulieren.",
            },
         ],
         product_status: {
            known_affected: [
               "T040073",
            ],
         },
         release_date: "2025-01-08T23:00:00.000+00:00",
         title: "CVE-2025-0103",
      },
      {
         cve: "CVE-2025-0104",
         notes: [
            {
               category: "description",
               text: "In PaloAlto Networks Expedition existiert eine Cross-Site Scripting Schwachstelle. HTML und Script-Eingaben werden in Expedition nicht ordnungsgemäß überprüft, bevor sie an den Benutzer zurückgegeben werden. Ein entfernter, anonymer Angreifer kann durch Ausnutzung dieser Schwachstelle beliebigen HTML- und Script-Code durch den Browser des Benutzers im Kontext der betroffenen Seite ausführen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.",
            },
         ],
         product_status: {
            known_affected: [
               "T040073",
            ],
         },
         release_date: "2025-01-08T23:00:00.000+00:00",
         title: "CVE-2025-0104",
      },
      {
         cve: "CVE-2025-0105",
         notes: [
            {
               category: "description",
               text: "Es existiert eine Schwachstelle in PaloAlto Networks Expedition. Es handelt sich um eine Schwachstelle es ermöglicht Dateien auf dem Expidition Datei-System zu löschen. Ein entfernter, anonymer Angreifer kann diese Ausnutzen um Dateien zu manipulieren oder zu löschen .",
            },
         ],
         product_status: {
            known_affected: [
               "T040073",
            ],
         },
         release_date: "2025-01-08T23:00:00.000+00:00",
         title: "CVE-2025-0105",
      },
      {
         cve: "CVE-2025-0106",
         notes: [
            {
               category: "description",
               text: "Es existiert eine Schwachstelle in PaloAlto Networks Expedition. Es handelt sich um eine \"wildcard expansion\"-Schwachstelle, die die unsichere Handhabung von Wildcards für Dateien und Argumente ausnutzt. Ein entfernter, anonymer Angreifer kann dadurch Schädliche Dateien anlegen oder Informationen Manipulieren.",
            },
         ],
         product_status: {
            known_affected: [
               "T040073",
            ],
         },
         release_date: "2025-01-08T23:00:00.000+00:00",
         title: "CVE-2025-0106",
      },
      {
         cve: "CVE-2025-0107",
         notes: [
            {
               category: "description",
               text: "Es existiert eine Schwachstelle in PaloAlto Networks Expedition. Hierbei handelt es sich um eine OS Command Injection-Schwachstelle, die es ermöglicht, ohne ausreichende Validierung schädliche Eingaben in das Betriebssystem vorzunehmen. Ein entfernter, authentisierter Angreifer kann beliebige OS Befehle ausführen und dadurch weitere Informationen offenlegen.",
            },
         ],
         product_status: {
            known_affected: [
               "T040073",
            ],
         },
         release_date: "2025-01-08T23:00:00.000+00:00",
         title: "CVE-2025-0107",
      },
   ],
}

ghsa-qfq8-mv2q-hvwp

Vulnerability from github

Published

2025-01-11 03:30

Modified

2025-01-11 03:30

Severity ?

7.0 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber

Details

Show details on source website

JSON

To clipboard

{
   affected: [],
   aliases: [
      "CVE-2025-0104",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-79",
      ],
      github_reviewed: false,
      github_reviewed_at: null,
      nvd_published_at: "2025-01-11T03:15:22Z",
      severity: "HIGH",
   },
   details: "A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.",
   id: "GHSA-qfq8-mv2q-hvwp",
   modified: "2025-01-11T03:30:40Z",
   published: "2025-01-11T03:30:40Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2025-0104",
      },
      {
         type: "WEB",
         url: "https://security.paloaltonetworks.com/PAN-SA-2025-0001",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Amber",
         type: "CVSS_V4",
      },
   ],
}

fkie_cve-2025-0104

Vulnerability from fkie_nvd

Published

2025-01-11 03:15

Modified

2025-01-11 03:15

Severity ?

7.0 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber

Summary

References

▼	URL	Tags
	psirt@paloaltonetworks.com	https://security.paloaltonetworks.com/PAN-SA-2025-0001

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
   cveTags: [
      {
         sourceIdentifier: "psirt@paloaltonetworks.com",
         tags: [
            "unsupported-when-assigned",
         ],
      },
   ],
   descriptions: [
      {
         lang: "en",
         value: "A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad de cross-site scripting (XSS) reflejado en Palo Alto Networks Expedition permite a los atacantes ejecutar código JavaScript malicioso en el contexto del navegador de un usuario autenticado de Expedition si ese usuario autenticado hace clic en un enlace malicioso que permite ataques de phishing y podría conducir al robo de la sesión del navegador de Expedition.",
      },
   ],
   id: "CVE-2025-0104",
   lastModified: "2025-01-11T03:15:22.183",
   metrics: {
      cvssMetricV40: [
         {
            cvssData: {
               Automatable: "NO",
               Recovery: "USER",
               Safety: "NOT_DEFINED",
               attackComplexity: "LOW",
               attackRequirements: "NONE",
               attackVector: "NETWORK",
               availabilityRequirement: "NOT_DEFINED",
               baseScore: 7,
               baseSeverity: "HIGH",
               confidentialityRequirement: "NOT_DEFINED",
               exploitMaturity: "NOT_DEFINED",
               integrityRequirement: "NOT_DEFINED",
               modifiedAttackComplexity: "NOT_DEFINED",
               modifiedAttackRequirements: "NOT_DEFINED",
               modifiedAttackVector: "NOT_DEFINED",
               modifiedPrivilegesRequired: "NOT_DEFINED",
               modifiedSubAvailabilityImpact: "NOT_DEFINED",
               modifiedSubConfidentialityImpact: "NOT_DEFINED",
               modifiedSubIntegrityImpact: "NOT_DEFINED",
               modifiedUserInteraction: "NOT_DEFINED",
               modifiedVulnAvailabilityImpact: "NOT_DEFINED",
               modifiedVulnConfidentialityImpact: "NOT_DEFINED",
               modifiedVulnIntegrityImpact: "NOT_DEFINED",
               privilegesRequired: "NONE",
               providerUrgency: "AMBER",
               subAvailabilityImpact: "NONE",
               subConfidentialityImpact: "NONE",
               subIntegrityImpact: "NONE",
               userInteraction: "ACTIVE",
               valueDensity: "CONCENTRATED",
               vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Amber",
               version: "4.0",
               vulnAvailabilityImpact: "NONE",
               vulnConfidentialityImpact: "HIGH",
               vulnIntegrityImpact: "LOW",
               vulnerabilityResponseEffort: "HIGH",
            },
            source: "psirt@paloaltonetworks.com",
            type: "Secondary",
         },
      ],
   },
   published: "2025-01-11T03:15:22.183",
   references: [
      {
         source: "psirt@paloaltonetworks.com",
         url: "https://security.paloaltonetworks.com/PAN-SA-2025-0001",
      },
   ],
   sourceIdentifier: "psirt@paloaltonetworks.com",
   vulnStatus: "Awaiting Analysis",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "psirt@paloaltonetworks.com",
         type: "Secondary",
      },
   ],
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2025-0104

Vulnerability from cvelistv5

wid-sec-w-2025-0037

Vulnerability from csaf_certbund

ghsa-qfq8-mv2q-hvwp

Vulnerability from github

fkie_cve-2025-0104

Vulnerability from fkie_nvd

Tags

Sightings

Nomenclature