CVE-2023-25837: BUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS.
There is a Cross-site Scripting vulnerability in Esri Portal Sites in versions 10.8.1 – 10.9 that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victims browser. The privileges required to execute this attack are high.
Other sources
There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could result in the execution of arbitrary JavaScript code in the target’s browser. Exploitation requires high‑privileged authenticated access. Successful exploitation may allow the attacker to access sensitive session data, manipulate trusted content, and disrupt normal application functionality, resulting in a high impact to confidentiality, integrity, and availability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-25837?
CVE-2023-25837 is a Cross-site Scripting vulnerability in Esri Portal Sites in versions 10.8.1 - 10.9 that allows a remote, authenticated attacker to execute arbitrary JavaScript code in the victim's browser.
How severe is CVE-2023-25837?
CVE-2023-25837 has a severity value of 6.8, which is classified as medium.
Which software versions are affected by CVE-2023-25837?
CVE-2023-25837 affects Esri Portal Sites in versions 10.8.1 - 10.9.
How can an attacker exploit CVE-2023-25837?
An attacker can exploit CVE-2023-25837 by creating a crafted link and tricking the victim into clicking on it, which can then execute arbitrary JavaScript code in the victim's browser.
Is there a security patch available for CVE-2023-25837?
Yes, a security patch is available for CVE-2023-25837. Please refer to the following reference for more information: [link](https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-enterprise-sites-security-patch-is-now-available/)