CVE-2024-25699: Portal for ArcGIS has an invalid authentication vulnerability
There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux, and ArcGIS Enterprise versions 11.1 and below on Kubernetes, which under unique circumstances could allow a remote, authenticated attacker with low‑privileged access to compromise the confidentiality, integrity, and availability of the software. Successful exploitation allows the attacker to cross an authentication and authorization boundary beyond their originally assigned access, resulting in a scope change.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25699?
The severity of CVE-2024-25699 is considered high due to the potential for improper authentication that could be exploited remotely.
How do I fix CVE-2024-25699?
To fix CVE-2024-25699, update the Esri Portal for ArcGIS to version 11.2 or higher or ArcGIS Enterprise to version 11.2 or above.
What systems are affected by CVE-2024-25699?
CVE-2024-25699 affects Esri Portal for ArcGIS versions 10.8.1 through 11.2 and ArcGIS Enterprise version 11.1 and below.
Is CVE-2024-25699 a local or remote vulnerability?
CVE-2024-25699 is classified as a remote vulnerability that can be exploited under specific conditions.
What is the nature of the vulnerability in CVE-2024-25699?
CVE-2024-25699 is an improper authentication issue that could allow unauthorized access to the Home application in affected software.