CVE-2023-25831: BUG-000154236 There is a reflected cross-site scripting (XSS) vulnerability in Portal for ArcGIS.

Published May 9, 2023

Updated

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1, 10.8.1 and 10.7.1 which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.

Other sources

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.

— MITRE

Affected Software

3 affected components

Esri Portal for ArcGIS=10.7.1

Esri Portal for ArcGIS=10.8.1

Esri Portal for ArcGIS=10.9.1

Event History

May 9, 2023

CVE Published

via MITRE·08:45 PM

Data Sourced

via MITRE·08:45 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2023-25831?

CVE-2023-25831 is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1, 10.8.1, and 10.7.1.

How does CVE-2023-25831 affect Esri Portal for ArcGIS?

CVE-2023-25831 may allow a remote, unauthenticated attacker to create a crafted link which, when clicked, could potentially execute arbitrary JavaScript code in the victim's browser.

What is the severity of CVE-2023-25831?

CVE-2023-25831 has a severity rating of medium.

Which versions of Esri Portal for ArcGIS are affected by CVE-2023-25831?

Esri Portal for ArcGIS versions 10.9.1, 10.8.1, and 10.7.1 are affected by CVE-2023-25831.

How can I fix CVE-2023-25831?

To fix CVE-2023-25831, apply the Portal for ArcGIS Security 2023 Update 1 Patch by following the instructions provided by Esri.