CVE-2023-25833: BUG-000155004 HTML injection issue in Portal for ArcGIS.
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser (no stateful change made or customer data rendered).
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2023-25833?
CVE-2023-25833 is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that allows a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim's browser.
What is the severity of CVE-2023-25833?
The severity of CVE-2023-25833 is medium with a CVSS score of 5.4.
How can an attacker exploit CVE-2023-25833?
An attacker can exploit CVE-2023-25833 by creating a crafted link that, when clicked by a victim, renders arbitrary HTML in their browser.
Is there a patch available for CVE-2023-25833?
Yes, a patch is available for CVE-2023-25833. It can be found at the following link: [Portal for ArcGIS Security 2023 Update 1 Patch](https://support.esri.com/en-us/patches-updates/2023/portal-for-arcgis-security-2023-update-1-patch-8095)
What is the Common Weakness Enumeration (CWE) associated with CVE-2023-25833?
The Common Weakness Enumeration (CWE) associated with CVE-2023-25833 are CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) and CWE-79 (Improper Neutralization of Input During Web Page Generation).