Home

Description

A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link. The primary risk is phishing attacks that can lead to credential theft—particularly if you enabled Clientless VPN. There is no availability impact to GlobalProtect features or GlobalProtect users. Attackers cannot use this vulnerability to tamper with or modify contents or configurations of the GlobalProtect portal or gateways. The integrity impact of this vulnerability is limited to enabling an attacker to create phishing and credential-stealing links that appear to be hosted on the GlobalProtect portal. For GlobalProtect users with Clientless VPN enabled, there is a limited impact on confidentiality due to inherent risks of Clientless VPN that facilitate credential theft. You can read more about this risk in the informational bulletin PAN-SA-2025-0005 https://security.paloaltonetworks.com/PAN-SA-2025-0005 https://security.paloaltonetworks.com/PAN-SA-2025-0005 . There is no impact to confidentiality for GlobalProtect users if you did not enable (or you disable) Clientless VPN.

PUBLISHED Reserved 2024-12-20 | Published 2025-05-14 | Updated 2026-04-02 | Assigner palo_alto




LOW: 1.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/U:Amber

Without Clientless VPN

LOW: 2.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/S:N/AU:N/R:U/V:D/RE:M/U:Amber

With Clientless VPN enabled, there are inherent risks that facilitate credential stealing (enumerated in PAN-SA-2025-0005).

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status
unaffected

All (custom) before 11.2.8
affected

Default status
unaffected

11.2.0 (custom) before 11.2.7
affected

11.1.0 (custom) before 11.1.6-h14
affected

10.2.0 (custom) before 10.2.16-h1
affected

10.1.0 (custom)
affected

Default status
affected

All (custom)
affected

Timeline

2025-07-09:Added fix version for PAN-OS 10.2.
2025-07-04:Added Releases with the Software Fix, Updated Recommended Content Version, and Added Guidance for Prisma Access.
2025-06-18:Changed Content Version for Mitigation and Updated Version ETAs
2025-05-21:Removed Cloud NGFW from Affected Products
2025-05-21:Removed Prisma Access from Affected Products.
2025-05-15:Changed Expected Fix Release for PAN-OS 11.2
2025-05-15:Added Prisma Access and Cloud NGFW to Affected Products.
2025-05-14:Initial Publication

Credits

XBOW finder

References

security.paloaltonetworks.com/CVE-2025-0133 vendor-advisory

cve.org (CVE-2025-0133)

nvd.nist.gov (CVE-2025-0133)

Download JSON