CVE-2023-25830: BUG-000154662 Reflected XSS vulnerability in Portal for ArcGIS

Published May 9, 2023

Updated

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1, 10.8.1 and 10.7.1 which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.

Other sources

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and before which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.

— MITRE

Affected Software

3 affected components

Esri Portal for ArcGIS=10.7.1

Esri Portal for ArcGIS=10.8.1

Esri Portal for ArcGIS=10.9.1

Remediation

Information

https://support.esri.com/en-us/patches-updates/2023/portal-for-arcgis-security-2023-update-1-patch-8... https://support.esri.com/en-us/patches-updates/2023/portal-for-arcgis-security-2023-update-1-patch-8095

Event History

May 9, 2023

CVE Published

via MITRE·04:31 PM

Data Sourced

via MITRE·04:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2023-25830?

CVE-2023-25830 is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1, 10.8.1, and 10.7.1.

What is the severity of CVE-2023-25830?

CVE-2023-25830 has a severity rating of 6.1, which is considered medium.

Which software versions are affected by CVE-2023-25830?

Esri Portal for ArcGIS versions 10.9.1, 10.8.1, and 10.7.1 are affected by CVE-2023-25830.

How does CVE-2023-25830 work?

CVE-2023-25830 allows a remote, unauthenticated attacker to create a crafted link that executes arbitrary JavaScript code in the victim's browser when clicked.

How can I fix CVE-2023-25830?

To fix CVE-2023-25830, apply the Portal for ArcGIS Security 2023 Update 1 Patch, which is available from the Esri support website.