CVE-2023-25840: BUG-000154070 Stored XSS issue in the ArcGIS REST Services directory
There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 10.8.1 – 11.1 that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser. The privileges required to execute this attack are high.
Other sources
There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser. The privileges required to execute this attack are high.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-25840?
CVE-2023-25840 is a Cross-site Scripting vulnerability in ArcGIS Server in versions 10.8.1 - 11.1.
How severe is CVE-2023-25840?
CVE-2023-25840 has a severity rating of low, with a CVSS score of 3.4.
How does CVE-2023-25840 work?
CVE-2023-25840 allows a remote, authenticated attacker to create a crafted link that may render an image in the victim's browser.
Which software versions are affected by CVE-2023-25840?
CVE-2023-25840 affects ArcGIS Server versions 10.8.1 - 11.1.
How do I fix CVE-2023-25840?
To fix CVE-2023-25840, apply the ArcGIS Server Security 2023 Update 1 patch which is available at the provided reference link.