CVE-2025-0103

Expedition: SQL Injection Vulnerability

State: Published
Severity: 9.2 Critical
Published: Jan 11, 2025
Updated: Jan 13, 2025
Reserved: Dec 20, 2024

Description

An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. This vulnerability also enables attackers to create and read arbitrary files on the Expedition system.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Amber	palo_alto

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
Cloud NGFWPalo Alto Networks	AllNot affected
ExpeditionPalo Alto Networks	1 to before 1.2.100Affectedfrom 1.2.100Not affected
PanoramaPalo Alto Networks	AllNot affected
PAN-OSPalo Alto Networks	AllNot affected
Prisma AccessPalo Alto Networks	AllNot affected

References

https://security.paloaltonetworks.com/PAN-SA-2025-0001vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.