Palo Alto Networks Expedition fixes 5 vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Palo Alto Networks Expedition fixes 5 vulnerabilities

Palo Alto Networks fixes 5 vulnerabilities in the Expedition product with version 1.2.101. This version is also the last one released, as the product has reached end of life. As a temporary workaround for all disclosed vulnerabilities, access from untrusted sources can be blocked [1]. The most severe vulnerabilities are listed below.

Palo Alto Networks Expedition - SQL injection (CVE-2025-0103)

CVSS 7.1 (High)

Allows an authenticated remote attacker to perform an SQL injection attack, resulting in the leak of sensitive information such as password hashes and API access keys [1].

The vulnerability is present in product:

Palo Alto Networks Expedition; <1.2.101;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

More information:

CVE-2025-0103 at cve.org, NVD
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 8. 1. 2025.

Palo Alto Networks Expedition - XSS (CVE-2025-0104)

CVSS 7.1 (High)

Allows an unauthenticated remote attacker to perform an XSS attack using social engineering [1].

The vulnerability is present in product:

Palo Alto Networks Expedition; <1.2.101;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

More information:

CVE-2025-0104 at cve.org, NVD
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 8. 1. 2025.

Palo Alto Networks Expedition - OS command execution (CVE-2025-0107)

CVSS 7.4 (High)

Allows an authenticated remote attacker with www-data privileges to execute operating system commands, resulting in the leak of sensitive information such as usernames, passwords and API access keys to firewalls [1].

The vulnerability is present in product:

Palo Alto Networks Expedition; <1.2.101;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

More information:

CVE-2025-0107 at cve.org, NVD
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 8. 1. 2025.

Report feedback

[TLP:CLEAR] Palo Alto Networks Expedition fixes 5 vulnerabilities

Palo Alto Networks Expedition - SQL injection (CVE-2025-0103)

CVSS 7.1 (High)

Palo Alto Networks Expedition - XSS (CVE-2025-0104)

CVSS 7.1 (High)

Palo Alto Networks Expedition - OS command execution (CVE-2025-0107)

CVSS 7.4 (High)

Links