CVE-2025-0125 — Improper Neutralization of Script in Attributes in a Web Page in Palo Alto Networks Pan-os

CWE-83 — Improper Neutralization of Script in Attributes in a Web Page7 documents5 sources
Severity
6.9MEDIUMNVD
EPSS
0.5%
top 32.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Palo Alto Networks Pan-osPaloalto Cloud NgfwPaloalto Pan-os+1 more
Timeline
PublishedApr 11

Description

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our rec…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/S:N

Affected Packages4 packages

▶CVEListV5palo_alto_networks/pan-os11.2.0 — 11.2.5+4
▶Palo Altopaloalto/pan-os

🔴Vulnerability Details

2
GHSA
GHSA-7f96-hg3w-w868: An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenti↗2025-04-11
▶
CVEList
PAN-OS: Improper Neutralization of Input in the Management Web Interface↗2025-04-11
▶

📋Vendor Advisories

1
Palo Alto
PAN-OS: Improper Neutralization of Input in the Management Web Interface↗
▶
CVE-2025-0125 — Palo Alto Networks Pan-os vulnerability | cvebase