Palo Alto Cloud NGFW/PAN-OS up to 6.3.2 Management Web Interface cross site scripting

Summaryinfo

A vulnerability categorized as problematic has been discovered in Palo Alto Cloud NGFW and PAN-OS up to 6.3.2. Affected by this vulnerability is an unknown functionality of the component Management Web Interface. The manipulation results in cross site scripting. This vulnerability is identified as CVE-2025-0137. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Palo Alto Cloud NGFW and PAN-OS up to 6.3.2. Affected is an unknown functionality of the component Management Web Interface. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-83. The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

The advisory is available at security.paloaltonetworks.com. This vulnerability is traded as CVE-2025-0137 since 12/21/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation needs additional levels of successful authentication. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

Upgrading to version 6.3.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-14905). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Firewall Software

Vendor

• Palo Alto

Name

• Cloud NGFW
• PAN-OS

Version

• 6.3.0
• 6.3.1
• 6.3.2

License

• commercial

Website

• Vendor: https://www.paloaltonetworks.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion