CVE-2025-0103CWE-89

Expedition: SQL Injection Vulnerability

Critical · published January 11, 2025

CVSS v4.0
9.2
EPSS
1%
Percentile
48.8
In the wild
Unconfirmed
What it is

An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. This vulnerability also enables attackers to create and read arbitrary files on the Expedition system.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber
EPSS
0.00614 · 48.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-01-11T02:59Z
EPSS history
Timeline
  • 11 JAN 02:59Z
    Expedition: SQL Injection Vulnerability
    cvelistv5