CVE-2024-25707: BUG-000160241 - Reflected XSS in Portal for ArcGIS
There is a reflected cross site scripting in Esri Portal for ArcGIS 11.1 and below on Windows and Linux x64 allows a remote authenticated attacker with administrative access to supply a crafted string which could potentially execute arbitrary JavaScript code in the their own browser (Self XSS). A user cannot be phished into clicking a link to execute code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25707?
CVE-2024-25707 is rated as a high-severity vulnerability due to the potential for executing arbitrary JavaScript code.
How do I fix CVE-2024-25707?
To mitigate CVE-2024-25707, update Esri Portal for ArcGIS to version 11.2 or later.
Who is affected by CVE-2024-25707?
CVE-2024-25707 affects users of Esri Portal for ArcGIS 11.1 and below on Windows and Linux x64 systems.
What kind of vulnerability is CVE-2024-25707?
CVE-2024-25707 is a reflected cross-site scripting (XSS) vulnerability.
Can CVE-2024-25707 be exploited remotely?
Yes, CVE-2024-25707 can be exploited remotely by authenticated attackers with administrative access.