BUG-000173918 - ArcGIS Enterprise Sites has a security vulnerability.
CVE-2025-55104

4.8MEDIUM

Key Information:

Vendor

Esri

Status
Portal For Arcgis Enterprise Sites
Vendor
CVE Published:
21 August 2025

What is CVE-2025-55104?

A stored cross-site scripting (XSS) vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create or edit a site to add and store an XSS payload. If this stored XSS payload is triggered by any user attacker supplied JavaScript may execute in the victim's browser.

Affected Version(s)

Portal for ArcGIS Enterprise Sites Windows 10.9.1 <= 11.4

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/ad...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-55104 : Stored Cross-Site Scripting Vulnerability in ArcGIS HUB and ArcGIS Enterprise Sites