CVE-2023-25837
BUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS.
In short
ArcGIS Enterprise Sites allows attackers with admin access to inject malicious code into links that execute in users' browsers when clicked, potentially stealing sensitive data or compromising the application.
Technical detail
Stored XSS vulnerability in ArcGIS Enterprise Sites ≤10.9 requiring authenticated, high-privileged attacker access to craft malicious links; successful exploitation enables arbitrary JavaScript execution in victim browsers, impacting confidentiality, integrity, and availability through session hijacking, content manipulation, and DoS.
Summary generated and translated by AI from the official description.
There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could result in the execution of arbitrary JavaScript code in the target’s browser. Exploitation requires high‑privileged authenticated access. Successful exploitation may allow the attacker to access sensitive session data, manipulate trusted content, and disrupt normal application functionality, resulting in a high impact to confidentiality, integrity, and availability.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected products
Esri · Portal for ArcGIS SitesWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →