Published: 11/01/2025 Updated: 11/01/2025

Reflected XSS Vulnerability in Palo Alto Networks Expedition

A reflected cross-site scripting (XSS) vulnerability exists in Palo Alto Networks Expedition. Attackers can run harmful JavaScript code in the browser of a user who is logged into Expedition if that user clicks on a harmful link. This can result in phishing attacks and the theft of the Expedition browser session.

This issue is fixed in Expedition 1.2.100 and all later versions* of Expedition.

* Expedition reached its End of Life (EoL) date https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642 and is no longer supported. We added these fixes prior to the EoL date and we do not plan to make any additional updates or security fixes. Please use the suggested alternatives listed in the Expedition End of Life Announcement https://live.paloaltonetworks.com/t5/expedition-articles/important-update-end-of-life-announcement-for-palo-alto-networks/ta-p/589642 .

Vulnerable Product	Search on Vulmon	Subscribe to Product
palo alto networks cloud ngfw
palo alto networks expedition
palo alto networks panorama
palo alto networks pan-os
palo alto networks prisma access

CWE-79 https://nvd.nist.gov https://www.first.org/epss https://security.paloaltonetworks.com/PAN-SA-2025-0001

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2025-0104

Vulnerability Summary

Solution

References

Vulmon Search

About

Products

Connect