cvelistv5 - cve-2025-0118

cve-2025-0118

Vulnerability from cvelistv5

Published

2025-03-12 18:36

Modified

2025-03-12 18:52

Severity ?

6.0 (Medium) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L/AU:N/R:U/V:D/RE:M/U:Amber

Summary

A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated user. However, to exploit this vulnerability, the authenticated user must navigate to a malicious page during the GlobalProtect SAML login process on a Windows device. This issue does not apply to the GlobalProtect app on other (non-Windows) platforms.

References

▼	URL	Tags
	psirt@paloaltonetworks.com	https://security.paloaltonetworks.com/CVE-2025-0118

Impacted products

Vendor

Product

Version

▼

Palo Alto Networks

GlobalProtect App

Patch: 6.3.0
Version: 6.2.0   < 6.2.5
Version: 6.1.0   < 6.1.6
Version: 6.0.0   < 6.0.11
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.4:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.3:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.2:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.1:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.0:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.5:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.4:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.3:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.2:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.1:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.0:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.8:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.7:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.6:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.5:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.4:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.3:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.2:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.1:-:*:*:*:*:*:*
    cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.0:-:*:*:*:*:*:*

	Palo Alto Networks	GlobalProtect App	Patch: All cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.4:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.3:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.2:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.1:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.0:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.5:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.4:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.3:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.2:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.1:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.0:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.8:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.7:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.6:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.5:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.4:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.3:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.2:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.1:-:::::: cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.0:-::::::
	Palo Alto Networks	GlobalProtect UWP App	Patch: All

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-0118",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-12T18:48:05.801831Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-12T18:52:08.115Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               cpes: [
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.4:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.3:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.2:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.1:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.0:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.5:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.4:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.3:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.2:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.1:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.0:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.8:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.7:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.6:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.5:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.4:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.3:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.2:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.1:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.0:-:*:*:*:*:*:*",
               ],
               defaultStatus: "unaffected",
               platforms: [
                  "Windows",
               ],
               product: "GlobalProtect App",
               vendor: "Palo Alto Networks",
               versions: [
                  {
                     changes: [
                        {
                           at: "6.3.3",
                           status: "unaffected",
                        },
                     ],
                     lessThan: "6.3.3",
                     status: "unaffected",
                     version: "6.3.0",
                     versionType: "custom",
                  },
                  {
                     changes: [
                        {
                           at: "6.2.5",
                           status: "unaffected",
                        },
                     ],
                     lessThan: "6.2.5",
                     status: "affected",
                     version: "6.2.0",
                     versionType: "custom",
                  },
                  {
                     changes: [
                        {
                           at: "6.1.6",
                           status: "unaffected",
                        },
                     ],
                     lessThan: "6.1.6",
                     status: "affected",
                     version: "6.1.0",
                     versionType: "custom",
                  },
                  {
                     changes: [
                        {
                           at: "6.0.11",
                           status: "unaffected",
                        },
                     ],
                     lessThan: "6.0.11",
                     status: "affected",
                     version: "6.0.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               cpes: [
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.4:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.3:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.2:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.1:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.0:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.5:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.4:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.3:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.2:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.1:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.0:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.8:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.7:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.6:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.5:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.4:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.3:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.2:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.1:-:*:*:*:*:*:*",
                  "cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.0:-:*:*:*:*:*:*",
               ],
               defaultStatus: "unaffected",
               platforms: [
                  "macOS",
                  "Linux",
                  "iOS",
                  "Android",
                  "Chrome OS",
               ],
               product: "GlobalProtect App",
               vendor: "Palo Alto Networks",
               versions: [
                  {
                     changes: [
                        {
                           at: "6.3.3",
                           status: "unaffected",
                        },
                     ],
                     lessThan: "6.3.3",
                     status: "unaffected",
                     version: "All",
                     versionType: "custom",
                  },
               ],
            },
            {
               defaultStatus: "unaffected",
               product: "GlobalProtect UWP App",
               vendor: "Palo Alto Networks",
               versions: [
                  {
                     status: "unaffected",
                     version: "All",
                     versionType: "custom",
                  },
               ],
            },
         ],
         configurations: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "You are vulnerable to this issue only if you configured GlobalProtect authentication to use SAML authentication.<br><br>You can verify whether you configured SAML authentication on your GlobalProtect portals by checking your firewall web interface (<b>Network</b> &gt; <b>GlobalProtect</b> &gt; <b>Portals</b> &gt; (portal-config) &gt; <b>Authentication</b>).",
                  },
               ],
               value: "You are vulnerable to this issue only if you configured GlobalProtect authentication to use SAML authentication.\n\nYou can verify whether you configured SAML authentication on your GlobalProtect portals by checking your firewall web interface (Network > GlobalProtect > Portals > (portal-config) > Authentication).",
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Maxime ESCOURBIAC, Michelin CERT",
            },
            {
               lang: "en",
               type: "finder",
               value: "Yassine BENGANA, Abicom for Michelin CERT",
            },
         ],
         datePublic: "2025-03-12T16:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated user. However, to exploit this vulnerability, the authenticated user must navigate to a malicious page during the GlobalProtect SAML login process on a Windows device.<br><br>This issue does not apply to the GlobalProtect app on other (non-Windows) platforms.&nbsp;",
                  },
               ],
               value: "A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated user. However, to exploit this vulnerability, the authenticated user must navigate to a malicious page during the GlobalProtect SAML login process on a Windows device.\n\nThis issue does not apply to the GlobalProtect app on other (non-Windows) platforms.",
            },
         ],
         exploits: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Palo Alto Networks is not aware of any malicious exploitation of this issue.",
                  },
               ],
               value: "Palo Alto Networks is not aware of any malicious exploitation of this issue.",
            },
         ],
         impacts: [
            {
               capecId: "CAPEC-104",
               descriptions: [
                  {
                     lang: "en",
                     value: "CAPEC-104 Cross Zone Scripting",
                  },
               ],
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  Automatable: "NO",
                  Recovery: "USER",
                  Safety: "NOT_DEFINED",
                  attackComplexity: "LOW",
                  attackRequirements: "PRESENT",
                  attackVector: "NETWORK",
                  baseScore: 6,
                  baseSeverity: "MEDIUM",
                  privilegesRequired: "NONE",
                  providerUrgency: "AMBER",
                  subAvailabilityImpact: "LOW",
                  subConfidentialityImpact: "LOW",
                  subIntegrityImpact: "LOW",
                  userInteraction: "ACTIVE",
                  valueDensity: "DIFFUSE",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L/AU:N/R:U/V:D/RE:M/U:Amber",
                  version: "4.0",
                  vulnAvailabilityImpact: "HIGH",
                  vulnConfidentialityImpact: "HIGH",
                  vulnIntegrityImpact: "LOW",
                  vulnerabilityResponseEffort: "MODERATE",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "An attacker deceives an authenticated Windows user and entices the user to navigate to a malicious web page during the GlobalProtect SAML login process.",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-618",
                     description: "CWE-618 Exposed Unsafe ActiveX Method",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-12T18:46:41.580Z",
            orgId: "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
            shortName: "palo_alto",
         },
         references: [
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.paloaltonetworks.com/CVE-2025-0118",
            },
         ],
         solutions: [
            {
               lang: "eng",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "The issue is addressed by hardening the browser embedded in GlobalProtect app to disallow ActiveX plugins. This security enhancement is implemented in patched versions of the GlobalProtect app, so upgrading resolves the issue.&nbsp;<br><br><table><thead><tr><th>Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr><td>GlobalProtect App 6.3 on Windows<br></td><td>Upgrade to 6.3.3 or later<br></td></tr><tr><td>GlobalProtect App 6.2 on Windows<br></td><td>Upgrade to 6.2.5 or later<br></td></tr><tr><td>GlobalProtect App 6.1 on Windows</td><td>Upgrade to 6.1.6 or later<br></td></tr><tr><td>GlobalProtect App 6.0 on Windows<br></td><td>Upgrade to 6.0.11 or later<br></td></tr><tr><td>GlobalProtect App on macOS</td><td>No action needed</td></tr><tr><td>GlobalProtect App on Linux</td><td>No action needed</td></tr><tr><td>GlobalProtect App on iOS</td><td>No action needed</td></tr><tr><td>GlobalProtect App on Android</td><td>No action needed</td></tr><tr><td>GlobalProtect UWP App</td><td>No action needed</td></tr></tbody></table>",
                  },
               ],
               value: "The issue is addressed by hardening the browser embedded in GlobalProtect app to disallow ActiveX plugins. This security enhancement is implemented in patched versions of the GlobalProtect app, so upgrading resolves the issue. \n\nVersion\nSuggested Solution\nGlobalProtect App 6.3 on Windows\nUpgrade to 6.3.3 or later\nGlobalProtect App 6.2 on Windows\nUpgrade to 6.2.5 or later\nGlobalProtect App 6.1 on WindowsUpgrade to 6.1.6 or later\nGlobalProtect App 6.0 on Windows\nUpgrade to 6.0.11 or later\nGlobalProtect App on macOSNo action neededGlobalProtect App on LinuxNo action neededGlobalProtect App on iOSNo action neededGlobalProtect App on AndroidNo action neededGlobalProtect UWP AppNo action needed",
            },
         ],
         source: {
            defect: [
               "GPC-19859",
            ],
            discovery: "EXTERNAL",
         },
         title: "GlobalProtect App: Execution of Unsafe ActiveX Control Vulnerability",
         workarounds: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "You can mitigate this issue by using a different form of authentication for the GlobalProtect portal such as Client Certificate Authentication, RADIUS, TACACS+, LDAP, or Kerberos. You can find information about configuring authentication for the GlobalProtect portal in this <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-web-interface-help/globalprotect/network-globalprotect-portals/globalprotect-portals-authentication-configuration-tab\">documentation</a>.",
                  },
               ],
               value: "You can mitigate this issue by using a different form of authentication for the GlobalProtect portal such as Client Certificate Authentication, RADIUS, TACACS+, LDAP, or Kerberos. You can find information about configuring authentication for the GlobalProtect portal in this  documentation https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-web-interface-help/globalprotect/network-globalprotect-portals/globalprotect-portals-authentication-configuration-tab .",
            },
         ],
         x_affectedList: [
            "GlobalProtect App 6.2.4",
            "GlobalProtect App 6.2.3",
            "GlobalProtect App 6.2.2",
            "GlobalProtect App 6.2.1",
            "GlobalProtect App 6.2.0",
            "GlobalProtect App 6.2",
            "GlobalProtect App 6.1.5",
            "GlobalProtect App 6.1.4",
            "GlobalProtect App 6.1.3",
            "GlobalProtect App 6.1.2",
            "GlobalProtect App 6.1.1",
            "GlobalProtect App 6.1.0",
            "GlobalProtect App 6.1",
            "GlobalProtect App 6.0.8",
            "GlobalProtect App 6.0.7",
            "GlobalProtect App 6.0.6",
            "GlobalProtect App 6.0.5",
            "GlobalProtect App 6.0.4",
            "GlobalProtect App 6.0.3",
            "GlobalProtect App 6.0.2",
            "GlobalProtect App 6.0.1",
            "GlobalProtect App 6.0.0",
            "GlobalProtect App 6.0",
         ],
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
      assignerShortName: "palo_alto",
      cveId: "CVE-2025-0118",
      datePublished: "2025-03-12T18:36:44.290Z",
      dateReserved: "2024-12-20T23:23:19.630Z",
      dateUpdated: "2025-03-12T18:52:08.115Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2025-0118\",\"sourceIdentifier\":\"psirt@paloaltonetworks.com\",\"published\":\"2025-03-12T19:15:38.040\",\"lastModified\":\"2025-03-12T19:15:38.040\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated user. However, to exploit this vulnerability, the authenticated user must navigate to a malicious page during the GlobalProtect SAML login process on a Windows device.\\n\\nThis issue does not apply to the GlobalProtect app on other (non-Windows) platforms.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"psirt@paloaltonetworks.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber\",\"baseScore\":6.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NO\",\"Recovery\":\"USER\",\"valueDensity\":\"DIFFUSE\",\"vulnerabilityResponseEffort\":\"MODERATE\",\"providerUrgency\":\"AMBER\"}}]},\"weaknesses\":[{\"source\":\"psirt@paloaltonetworks.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-618\"}]}],\"references\":[{\"url\":\"https://security.paloaltonetworks.com/CVE-2025-0118\",\"source\":\"psirt@paloaltonetworks.com\"}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-0118\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-12T18:48:05.801831Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-12T18:52:02.514Z\"}}], \"cna\": {\"title\": \"GlobalProtect App: Execution of Unsafe ActiveX Control Vulnerability\", \"source\": {\"defect\": [\"GPC-19859\"], \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Maxime ESCOURBIAC, Michelin CERT\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Yassine BENGANA, Abicom for Michelin CERT\"}], \"impacts\": [{\"capecId\": \"CAPEC-104\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-104 Cross Zone Scripting\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"USER\", \"baseScore\": 6, \"Automatable\": \"NO\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"DIFFUSE\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L/AU:N/R:U/V:D/RE:M/U:Amber\", \"providerUrgency\": \"AMBER\", \"userInteraction\": \"ACTIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"LOW\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"MODERATE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"An attacker deceives an authenticated Windows user and entices the user to navigate to a malicious web page during the GlobalProtect SAML login process.\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.4:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.3:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.2:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.1:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.0:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.5:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.4:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.3:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.2:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.1:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.0:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.8:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.7:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.6:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.5:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.4:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.3:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.2:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.1:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.0:-:*:*:*:*:*:*\"], \"vendor\": \"Palo Alto Networks\", \"product\": \"GlobalProtect App\", \"versions\": [{\"status\": \"unaffected\", \"changes\": [{\"at\": \"6.3.3\", \"status\": \"unaffected\"}], \"version\": \"6.3.0\", \"lessThan\": \"6.3.3\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"6.2.5\", \"status\": \"unaffected\"}], \"version\": \"6.2.0\", \"lessThan\": \"6.2.5\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"6.1.6\", \"status\": \"unaffected\"}], \"version\": \"6.1.0\", \"lessThan\": \"6.1.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"6.0.11\", \"status\": \"unaffected\"}], \"version\": \"6.0.0\", \"lessThan\": \"6.0.11\", \"versionType\": \"custom\"}], \"platforms\": [\"Windows\"], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.4:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.3:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.2:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.1:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.2.0:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.5:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.4:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.3:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.2:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.1:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.1.0:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.8:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.7:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.6:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.5:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.4:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.3:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.2:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.1:-:*:*:*:*:*:*\", \"cpe:2.3:a:paloaltonetworks:globalprotect_app:6.0.0:-:*:*:*:*:*:*\"], \"vendor\": \"Palo Alto Networks\", \"product\": \"GlobalProtect App\", \"versions\": [{\"status\": \"unaffected\", \"changes\": [{\"at\": \"6.3.3\", \"status\": \"unaffected\"}], \"version\": \"All\", \"lessThan\": \"6.3.3\", \"versionType\": \"custom\"}], \"platforms\": [\"macOS\", \"Linux\", \"iOS\", \"Android\", \"Chrome OS\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Palo Alto Networks\", \"product\": \"GlobalProtect UWP App\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"All\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"Palo Alto Networks is not aware of any malicious exploitation of this issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Palo Alto Networks is not aware of any malicious exploitation of this issue.\", \"base64\": false}]}], \"solutions\": [{\"lang\": \"eng\", \"value\": \"The issue is addressed by hardening the browser embedded in GlobalProtect app to disallow ActiveX plugins. This security enhancement is implemented in patched versions of the GlobalProtect app, so upgrading resolves the issue.\\u00a0\\n\\nVersion\\nSuggested Solution\\nGlobalProtect App 6.3 on Windows\\nUpgrade to 6.3.3 or later\\nGlobalProtect App 6.2 on Windows\\nUpgrade to 6.2.5 or later\\nGlobalProtect App 6.1 on WindowsUpgrade to 6.1.6 or later\\nGlobalProtect App 6.0 on Windows\\nUpgrade to 6.0.11 or later\\nGlobalProtect App on macOSNo action neededGlobalProtect App on LinuxNo action neededGlobalProtect App on iOSNo action neededGlobalProtect App on AndroidNo action neededGlobalProtect UWP AppNo action needed\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The issue is addressed by hardening the browser embedded in GlobalProtect app to disallow ActiveX plugins. This security enhancement is implemented in patched versions of the GlobalProtect app, so upgrading resolves the issue.&nbsp;<br><br><table><thead><tr><th>Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr><td>GlobalProtect App 6.3 on Windows<br></td><td>Upgrade to 6.3.3 or later<br></td></tr><tr><td>GlobalProtect App 6.2 on Windows<br></td><td>Upgrade to 6.2.5 or later<br></td></tr><tr><td>GlobalProtect App 6.1 on Windows</td><td>Upgrade to 6.1.6 or later<br></td></tr><tr><td>GlobalProtect App 6.0 on Windows<br></td><td>Upgrade to 6.0.11 or later<br></td></tr><tr><td>GlobalProtect App on macOS</td><td>No action needed</td></tr><tr><td>GlobalProtect App on Linux</td><td>No action needed</td></tr><tr><td>GlobalProtect App on iOS</td><td>No action needed</td></tr><tr><td>GlobalProtect App on Android</td><td>No action needed</td></tr><tr><td>GlobalProtect UWP App</td><td>No action needed</td></tr></tbody></table>\", \"base64\": false}]}], \"datePublic\": \"2025-03-12T16:00:00.000Z\", \"references\": [{\"url\": \"https://security.paloaltonetworks.com/CVE-2025-0118\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"You can mitigate this issue by using a different form of authentication for the GlobalProtect portal such as Client Certificate Authentication, RADIUS, TACACS+, LDAP, or Kerberos. You can find information about configuring authentication for the GlobalProtect portal in this  documentation https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-web-interface-help/globalprotect/network-globalprotect-portals/globalprotect-portals-authentication-configuration-tab .\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"You can mitigate this issue by using a different form of authentication for the GlobalProtect portal such as Client Certificate Authentication, RADIUS, TACACS+, LDAP, or Kerberos. You can find information about configuring authentication for the GlobalProtect portal in this <a target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-web-interface-help/globalprotect/network-globalprotect-portals/globalprotect-portals-authentication-configuration-tab\\\">documentation</a>.\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated user. However, to exploit this vulnerability, the authenticated user must navigate to a malicious page during the GlobalProtect SAML login process on a Windows device.\\n\\nThis issue does not apply to the GlobalProtect app on other (non-Windows) platforms.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated user. However, to exploit this vulnerability, the authenticated user must navigate to a malicious page during the GlobalProtect SAML login process on a Windows device.<br><br>This issue does not apply to the GlobalProtect app on other (non-Windows) platforms.&nbsp;\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-618\", \"description\": \"CWE-618 Exposed Unsafe ActiveX Method\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"You are vulnerable to this issue only if you configured GlobalProtect authentication to use SAML authentication.\\n\\nYou can verify whether you configured SAML authentication on your GlobalProtect portals by checking your firewall web interface (Network > GlobalProtect > Portals > (portal-config) > Authentication).\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"You are vulnerable to this issue only if you configured GlobalProtect authentication to use SAML authentication.<br><br>You can verify whether you configured SAML authentication on your GlobalProtect portals by checking your firewall web interface (<b>Network</b> &gt; <b>GlobalProtect</b> &gt; <b>Portals</b> &gt; (portal-config) &gt; <b>Authentication</b>).\", \"base64\": false}]}], \"x_affectedList\": [\"GlobalProtect App 6.2.4\", \"GlobalProtect App 6.2.3\", \"GlobalProtect App 6.2.2\", \"GlobalProtect App 6.2.1\", \"GlobalProtect App 6.2.0\", \"GlobalProtect App 6.2\", \"GlobalProtect App 6.1.5\", \"GlobalProtect App 6.1.4\", \"GlobalProtect App 6.1.3\", \"GlobalProtect App 6.1.2\", \"GlobalProtect App 6.1.1\", \"GlobalProtect App 6.1.0\", \"GlobalProtect App 6.1\", \"GlobalProtect App 6.0.8\", \"GlobalProtect App 6.0.7\", \"GlobalProtect App 6.0.6\", \"GlobalProtect App 6.0.5\", \"GlobalProtect App 6.0.4\", \"GlobalProtect App 6.0.3\", \"GlobalProtect App 6.0.2\", \"GlobalProtect App 6.0.1\", \"GlobalProtect App 6.0.0\", \"GlobalProtect App 6.0\"], \"providerMetadata\": {\"orgId\": \"d6c1279f-00f6-4ef7-9217-f89ffe703ec0\", \"shortName\": \"palo_alto\", \"dateUpdated\": \"2025-03-12T18:46:41.580Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2025-0118\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-12T18:52:08.115Z\", \"dateReserved\": \"2024-12-20T23:23:19.630Z\", \"assignerOrgId\": \"d6c1279f-00f6-4ef7-9217-f89ffe703ec0\", \"datePublished\": \"2025-03-12T18:36:44.290Z\", \"assignerShortName\": \"palo_alto\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}

fkie_cve-2025-0118

Vulnerability from fkie_nvd

Published

2025-03-12 19:15

Modified

2025-03-12 19:15

Severity ?

6.0 (Medium) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L/AU:N/R:U/V:D/RE:M/U:Amber

Summary

References

▼	URL	Tags
	psirt@paloaltonetworks.com	https://security.paloaltonetworks.com/CVE-2025-0118

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated user. However, to exploit this vulnerability, the authenticated user must navigate to a malicious page during the GlobalProtect SAML login process on a Windows device.\n\nThis issue does not apply to the GlobalProtect app on other (non-Windows) platforms.",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad en la aplicación GlobalProtect de Palo Alto Networks para Windows permite a un atacante remoto ejecutar controles ActiveX en el contexto de un usuario autenticado de Windows. Esto permite al atacante ejecutar comandos como si fuera un usuario autenticado legítimo. Sin embargo, para explotar esta vulnerabilidad, el usuario autenticado debe acceder a una página maliciosa durante el proceso de inicio de sesión SAML de GlobalProtect en un dispositivo Windows. Este problema no afecta a la aplicación GlobalProtect en otras plataformas (no Windows).",
      },
   ],
   id: "CVE-2025-0118",
   lastModified: "2025-03-12T19:15:38.040",
   metrics: {
      cvssMetricV40: [
         {
            cvssData: {
               Automatable: "NO",
               Recovery: "USER",
               Safety: "NOT_DEFINED",
               attackComplexity: "LOW",
               attackRequirements: "PRESENT",
               attackVector: "NETWORK",
               availabilityRequirement: "NOT_DEFINED",
               baseScore: 6,
               baseSeverity: "MEDIUM",
               confidentialityRequirement: "NOT_DEFINED",
               exploitMaturity: "NOT_DEFINED",
               integrityRequirement: "NOT_DEFINED",
               modifiedAttackComplexity: "NOT_DEFINED",
               modifiedAttackRequirements: "NOT_DEFINED",
               modifiedAttackVector: "NOT_DEFINED",
               modifiedPrivilegesRequired: "NOT_DEFINED",
               modifiedSubAvailabilityImpact: "NOT_DEFINED",
               modifiedSubConfidentialityImpact: "NOT_DEFINED",
               modifiedSubIntegrityImpact: "NOT_DEFINED",
               modifiedUserInteraction: "NOT_DEFINED",
               modifiedVulnAvailabilityImpact: "NOT_DEFINED",
               modifiedVulnConfidentialityImpact: "NOT_DEFINED",
               modifiedVulnIntegrityImpact: "NOT_DEFINED",
               privilegesRequired: "NONE",
               providerUrgency: "AMBER",
               subAvailabilityImpact: "LOW",
               subConfidentialityImpact: "LOW",
               subIntegrityImpact: "LOW",
               userInteraction: "ACTIVE",
               valueDensity: "DIFFUSE",
               vectorString: "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
               version: "4.0",
               vulnAvailabilityImpact: "HIGH",
               vulnConfidentialityImpact: "HIGH",
               vulnIntegrityImpact: "LOW",
               vulnerabilityResponseEffort: "MODERATE",
            },
            source: "psirt@paloaltonetworks.com",
            type: "Secondary",
         },
      ],
   },
   published: "2025-03-12T19:15:38.040",
   references: [
      {
         source: "psirt@paloaltonetworks.com",
         url: "https://security.paloaltonetworks.com/CVE-2025-0118",
      },
   ],
   sourceIdentifier: "psirt@paloaltonetworks.com",
   vulnStatus: "Awaiting Analysis",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-618",
            },
         ],
         source: "psirt@paloaltonetworks.com",
         type: "Secondary",
      },
   ],
}

ghsa-4gx3-p432-m8m7

Vulnerability from github

Published

2025-03-12 21:31

Modified

2025-03-12 21:31

Severity ?

6.0 (Medium) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L/AU:N/R:U/V:D/RE:M/U:Amber

Details

This issue does not apply to the GlobalProtect app on other (non-Windows) platforms.

Show details on source website

JSON

To clipboard

{
   affected: [],
   aliases: [
      "CVE-2025-0118",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-618",
      ],
      github_reviewed: false,
      github_reviewed_at: null,
      nvd_published_at: "2025-03-12T19:15:38Z",
      severity: "MODERATE",
   },
   details: "A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated user. However, to exploit this vulnerability, the authenticated user must navigate to a malicious page during the GlobalProtect SAML login process on a Windows device.\n\nThis issue does not apply to the GlobalProtect app on other (non-Windows) platforms.",
   id: "GHSA-4gx3-p432-m8m7",
   modified: "2025-03-12T21:31:29Z",
   published: "2025-03-12T21:31:29Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2025-0118",
      },
      {
         type: "WEB",
         url: "https://security.paloaltonetworks.com/CVE-2025-0118",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber",
         type: "CVSS_V4",
      },
   ],
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2025-0118

Vulnerability from cvelistv5

fkie_cve-2025-0118

Vulnerability from fkie_nvd

ghsa-4gx3-p432-m8m7

Vulnerability from github

Tags

Sightings

Nomenclature