InfoSecBulletin Cybersecurity for mankind
Palo Alto Networks warns a reflected cross-site scripting (XSS) vulnerability, CVE-2025-0133, in the GlobalProtect gateway and portal features of its PAN-OS software. The flaw allows malicious JavaScript to run in the browsers of authenticated Captive Portal users when they click specific links.
Organizations using the Clientless VPN feature face a serious threat. While it has a low severity rating (CVSS Base Score 2.0) in default settings, the risk increases to MEDIUM (CVSS 5.5) when the Clientless VPN is active.
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
This issue is applicable only to PAN-OS firewall configurations with an enabled GlobalProtect gateway or portal. Palo Alto Networks is not aware of any malicious exploitation of this issue.
Mitigation Strategies:
Organizations running vulnerable versions should implement one of several available mitigations:
Upgrade to patched versions when available:
PAN-OS 11.2: Version 11.2.7 or later (expected June 2025).
PAN-OS 11.1: Version 11.1.11 or later (expected July 2025).
PAN-OS 10.2: Version 10.2.17 or later (expected August 2025).
Enable Threat Prevention IDs 510003 and 510004 (introduced in Applications and Threats content version 8970) for customers with Threat Prevention subscriptions and consider disabling Clientless VPN functionality entirely.
