PT-2023-20347 · Esri · Arcgis Server

CVE-2023-25840 · Publicado 2023-07-21 · Atualizado 2024-10-08

Positive Technologies (AI Summary)

CVSS v3.1

3.4

Baixa

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 10.8.1 through 11.1

Description The issue is related to a Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a crafted link. This link could potentially render an image in the victim's browser when the mouse is moved over it, but it will not execute. The privileges required to execute this attack are high.

Recommendations For ArcGIS Server versions 10.8.1 through 11.1, consider disabling the functionality that allows the creation of crafted links until a patch is available. Restrict access to sensitive areas of the server to minimize the risk of exploitation. Avoid using features that may trigger the onmouseover event in the affected browser. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-25840

Produtos afetados

Arcgis Server

Referências · 5

• https://t.me/cibsecurity/67111 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-25840 · Nota de Segurança
• https://t.me/cvenotify/72330 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25840 · Aviso do Fabricante
• https://esri.com/arcgis-blog/products/trust-arcgis/announcements/arcgis-server-security-2023-update-1-patch-available · Aviso do Fabricante