Reflected XSS Vulnerability in Esri Portal for ArcGIS Could Allow Remote Execution of Arbitrary JavaScript Code

CVE-2024-8149

What is CVE-2024-8149?

A reflected cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 11.1 and 11.2. This flaw allows a remote, unauthenticated attacker to craft a malicious link. When this link is clicked by a user, it can exploit the vulnerability, potentially executing arbitrary JavaScript code within the user's browser session. This poses significant risks, including the possibility of data theft, session hijacking, and other malicious activities due to the execution of unauthorized scripts.

References