CVE-2023-25837highCWE-79

CVE-2023-25837: high-severity vulnerability in Esri Portal for ArcGIS Sites

BUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS.

Published · Updated

Follow this CVE+ Monitor Portal for ArcGIS Sites

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.4epss 1.0%
In short

ArcGIS Enterprise Sites allows attackers with admin access to inject malicious code into links that execute in users' browsers when clicked, potentially stealing sensitive data or compromising the application.

Technical detail

Stored XSS vulnerability in ArcGIS Enterprise Sites ≤10.9 requiring authenticated, high-privileged attacker access to craft malicious links; successful exploitation enables arbitrary JavaScript execution in victim browsers, impacting confidentiality, integrity, and availability through session hijacking, content manipulation, and DoS.

Summary generated and translated by AI from the official description.
There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could result in the execution of arbitrary JavaScript code in the target’s browser. Exploitation requires high‑privileged authenticated access. Successful exploitation may allow the attacker to access sensitive session data, manipulate trusted content, and disrupt normal application functionality, resulting in a high impact to confidentiality, integrity, and availability.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected products
Esri · Portal for ArcGIS Sites
Related CVEs — Esri Portal for ArcGIS Sites

In the same product, most dangerous first.

CVE-2023-25835HIGHBUG-000153659 ArcGIS Enterprise Sites has a stored XSS vulnerabilityEPSS 0.9%CVE-2023-25836MEDIUMBUG-000135364 XSS in 10.8.1 sites builder iframe sourceEPSS 0.4%