CVE-2025-0104CWE-79

Expedition: Cross-Site Scripting (XSS) Vulnerability

High · published January 11, 2025

CVSS v4.0
7.0
EPSS
0%
Percentile
27.4
In the wild
Unconfirmed
What it is

A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber
EPSS
0.00350 · 27.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-01-11T03:00Z
EPSS history
Timeline
  • 11 JAN 03:00Z
    Expedition: Cross-Site Scripting (XSS) Vulnerability
    cvelistv5