CVE-2025-0104

Medium

Description

A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.

SeverityMedium

CVSS6.1

Exploit probability—

Product

Paloaltonetworks Expedition

PublishedJan 11, 2025

First seenJan 11, 2025

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

paloaltonetworks expedition1.2.101 or later

Vendor advisories

security.paloaltonetworks.com/PAN-SA-2025-0001

Affected products

Product	Affected versions	Fixed in
paloaltonetworks expedition	v < 1.2.101	1.2.101

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.