Lucene search

EsriCVELIST:CVE-2024-25696

HistoryApr 04, 2024 - 5:53 p.m.

CVE-2024-25696 Stored XSS in Portal for ArcGIS

2024-04-0417:53:55

CWE-79

Esri

www.cve.org

cve-2024-25696

stored xss

portal for arcgis

versions <=11.0

remote attacker

authenticated

crafted link

page editor

image render

victim’s browser

high privileges

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

5.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions <=11.0 that may allow a remote, authenticated attacker to create a crafted link which when accessing the page editor an image will render in the victim’s browser. The privileges required to execute this attack are high.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows",
      "Linux"
    ],
    "product": "Portal",
    "vendor": "Esri",
    "versions": [
      {
        "lessThanOrEqual": "<=110.",
        "status": "affected",
        "version": "10.8.1",
        "versionType": "11.0"
      }
    ]
  }
]

References

www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/