CVE-2024-25706: HTMLi at createFolder Content Injection
There is an HTML injection vulnerability in Esri Portal for ArcGIS <=11.0 that may allow a remote, unauthenticated attacker to craft a URL which, when clicked, could potentially generate a message that may entice an unsuspecting victim to visit an arbitrary website. This could simplify phishing attacks.
Other sources
There is an HTML injection vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL which, when clicked, could potentially generate a message that may entice an unsuspecting victim to visit an arbitrary website. This could simplify phishing attacks.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25706?
CVE-2024-25706 is considered a high-severity vulnerability due to its potential for HTML injection leading to phishing attacks.
How do I fix CVE-2024-25706?
To fix CVE-2024-25706, it is recommended to update Esri Portal for ArcGIS to version 11.1 or later.
Who is affected by CVE-2024-25706?
CVE-2024-25706 affects all versions of Esri Portal for ArcGIS up to and including version 11.0.
What type of attack does CVE-2024-25706 facilitate?
CVE-2024-25706 facilitates HTML injection attacks that can lead to phishing attempts against users.
Is authentication required to exploit CVE-2024-25706?
No, CVE-2024-25706 can be exploited by remote, unauthenticated attackers.