CVE-2024-25701: BUG-000160765 - Stored XSS in ArcGIS Experience Builder
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Experience Builder versions 10.8.1 – 11.1 that may allow a remote, authenticated attacker to create a crafted link that is stored in the Experience Builder Embed widget which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.
Other sources
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Experience Builder versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in the Experience Builder Embed widget which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25701?
CVE-2024-25701 is classified as a high severity vulnerability due to the potential for stored Cross-site Scripting attacks.
How do I fix CVE-2024-25701?
To mitigate CVE-2024-25701, update to a patched version of Esri Portal for ArcGIS Enterprise Experience Builder that addresses this vulnerability.
Who is affected by CVE-2024-25701?
CVE-2024-25701 affects users of Esri Portal for ArcGIS Enterprise Experience Builder versions 10.8.1 through 11.1.
What type of vulnerability is CVE-2024-25701?
CVE-2024-25701 is a stored Cross-site Scripting (XSS) vulnerability.
What can attackers do with CVE-2024-25701?
Attackers can exploit CVE-2024-25701 to execute arbitrary scripts in the context of a user's session when the crafted link is loaded.