Lucene search

EsriCVE-2023-25835

HistoryJul 21, 2023 - 12:15 a.m.

CVE-2023-25835

2023-07-2100:15:10

CWE-79

Esri

web.nvd.nist.gov

cve-2023-25835

cross-site scripting

esri portal

arcgis enterprise sites

security vulnerability

CVSS3

8.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

26.5%

JSON

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.8.1 – 11.1 that may allow a remote, authenticated attacker to create a crafted link that is stored in the site configuration which when clicked could potentially execute arbitrary JavaScript code in the victims browser. The privileges required to execute this attack are high. The impact to Confidentiality, Integrity and Availability are High.

Affected configurations

Nvd

Node

esriportal_for_arcgisRange10.8.1–11.1

VendorProductVersionCPE
esriportal_for_arcgis*cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
esri	portal_for_arcgis	*	cpe:2.3:a:esri:portal_for_arcgis::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "64 bit"
    ],
    "product": "Portal sites",
    "vendor": "Esri",
    "versions": [
      {
        "lessThanOrEqual": "11.1",
        "status": "affected",
        "version": "10.8.1",
        "versionType": "Portal for ArcGIS Enterprise Sites Security Patch"
      }
    ]
  }
]

References

www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-enterprise-sites-security-patch-is-now-available/

CVSS3

8.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

26.5%

JSON

Related for CVE-2023-25835