Stored XSS in Portal for ArcGIS
CVE-2024-25696

4.8MEDIUM

Key Information:

Vendor

Esri

Status
Portal For Arcgis
Vendor
CVE Published:
4 April 2024

What is CVE-2024-25696?

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when accessing the page editor an image will render in the victim’s browser. The privileges required to execute this attack are high.

Affected Version(s)

Portal for ArcGIS Windows All <= 11.0

References

https://www.esri.com/arcgis-blog/products/arcgis-enterpri...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.