CVE-2023-25841mediumCWE-79

CVE-2023-25841: fallo de gravedad media en Esri ArcGIS Enterprise Server

BUG-000158075 Stored XSS issue in ArcGIS Server

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear ArcGIS Enterprise Server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.1epss 0.6%
There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Mitigation: Disable anonymous access to ArcGIS Feature services with edit capabilities.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
Esri · ArcGIS Enterprise Server
CVEs relacionadas — Esri ArcGIS Enterprise Server

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-25840LOWBUG-000154070 Stored XSS issue in the ArcGIS REST Services directoryEPSS 0.5%CVE-2023-25848MEDIUMBUG-000158039 - There is an information disclosure issue in ArcGIS Server.EPSS 0.3%