Vulnerability · Published Jul 21, 2023 · Assigned by Esri
CVE-2023-25837BUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS.
High 8.4
In plain English
A high-severity cross-site scripting in Portal for ArcGIS Sites from Esri. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Official description
There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could result in the execution of arbitrary JavaScript code in the target’s browser. Exploitation requires high‑privileged authenticated access. Successful exploitation may allow the attacker to access sensitive session data, manipulate trusted content, and disrupt normal application functionality, resulting in a high impact to confidentiality, integrity, and availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Esri | Portal for ArcGIS Sites | All – through 10.9 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H