CVE-2025-0103

HIGH

8.8

Description

An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. This vulnerability also enables attackers to create and read arbitrary files on the Expedition system.

CVE Details

CVSS v3.1 Score8.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published1/11/2025

Last Modified1/23/2026

Sourcenvd

Honeypot Sightings0

Affected Products

paloaltonetworks:expedition

Weaknesses (CWE)

CWE-89

References

https://security.paloaltonetworks.com/PAN-SA-2025-0001(psirt@paloaltonetworks.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.