PT-2023-20347 · Esri · Arcgis Server

Published 2023-07-21 · Updated 2024-10-08 · CVE-2023-25840

Positive Technologies (AI Summary)

CVSS v3.1

3.4

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 10.8.1 through 11.1

Description The issue is related to a Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a crafted link. This link could potentially render an image in the victim's browser when the mouse is moved over it, but it will not execute. The privileges required to execute this attack are high.

Recommendations For ArcGIS Server versions 10.8.1 through 11.1, consider disabling the functionality that allows the creation of crafted links until a patch is available. Restrict access to sensitive areas of the server to minimize the risk of exploitation. Avoid using features that may trigger the onmouseover event in the affected browser. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-25840

Affected Products

Arcgis Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-25840 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25840 · Vendor Advisory
• https://esri.com/arcgis-blog/products/trust-arcgis/announcements/arcgis-server-security-2023-update-1-patch-available · Vendor Advisory
• https://t.me/cibsecurity/67111 · Telegram Post
• https://t.me/cvenotify/72330 · Telegram Post