Cross-site Scripting Vulnerability in Portal for ArcGIS Enterprise Web App Builder Could Allow Arbitrary JavaScript Code Execution
CVE-2024-25700

4.8MEDIUM

Key Information:

Vendor

Esri

Status
Arcgis Enterprise Builder
Vendor
CVE Published:
4 April 2024

What is CVE-2024-25700?

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in a web map link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high.

Affected Version(s)

ArcGIS Enterprise Builder x86 all <= 11.1

References

https://www.esri.com/arcgis-blog/products/arcgis-enterpri...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.
The Cyber Security Vulnerability Database.