CVE-2025-0104 - Expedition: Cross-Site Scripting (XSS) Vulnerability

Back Back to CVE browser

HIGH

Expedition: Cross-Site Scripting (XSS) Vulnerability

Published Jan 11, 2025

7.0

HIGH

CVSS 4.0

EPSS 0.36%

Description

A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.

Affected products

Vendor Palo Alto Networks Product Expedition Default
unaffected
Affected
- ≥ 1, < 1.2.100

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Palo Alto Networks	Expedition	unaffected	Affected ≥ 1, < 1.2.100

Remediation

Vendor solution

This issue is fixed in Expedition 1.2.100 and all later versions* of Expedition.

* Expedition reached its End of Life (EoL) date https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642 and is no longer supported. We added these fixes prior to the EoL date and we do not plan to make any additional updates or security fixes. Please use the suggested alternatives listed in the Expedition End of Life Announcement https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642 .

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)