CVE-2025-0104 — Cross-site Scripting in Palo Alto Networks Expedition

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
7.0HIGHNVD
EPSS
0.8%
top 26.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Palo Alto Networks ExpeditionPaloaltonetworks Expedition
Timeline
PublishedJan 11

Description

A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5palo_alto_networks/expedition1 — 1.2.100

🔴Vulnerability Details

2
GHSA
GHSA-qfq8-mv2q-hvwp: A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the co↗2025-01-11
▶
CVEList
Expedition: Cross-Site Scripting (XSS) Vulnerability↗2025-01-11
▶
CVE-2025-0104 — Cross-site Scripting in Palo | cvebase