/Vulnerability Library

PAN-OS - Reflected Cross-Site Scripting

CVE-2025-0133
Verified

Description

A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link.The primary risk is phishing attacks that can lead to credential theft—particularly if you enabled Clientless VPN.

Severity

Medium

Exploit Probability

46%

Affected Product

pan-os

Published Date

June 13, 2025

Template Author

xbow, dhiyaneshdk

CVE-2025-0133.yaml
5.0Severity

CVSS Metrics

References

https://security.paloaltonetworks.com/CVE-2025-0133https://hackerone.com/reports/3096384

Remediation Steps

Upgrade to the patched version of PAN-OS as specified in the vendor security advisory.