PT-2023-20348 · Esri · Esri Arcgis Server

Published 2023-07-21 · Updated 2024-10-08 · CVE-2023-25841

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Esri ArcGIS Server versions 10.8.1 through 11.0

Description There is a stored Cross-site Scripting issue that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.

Recommendations For Esri ArcGIS Server versions 10.8.1 through 11.0, disable anonymous access to ArcGIS Feature services with edit capabilities as a mitigation measure.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-25841

Affected Products

Esri Arcgis Server

References · 5

• https://osv.dev/vulnerability/CVE-2023-25841 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25841 · Security Note
• https://esri.com/arcgis-blog/products/trust-arcgis/announcements/arcgis-server-security-2023-update-1-patch-available · Vendor Advisory
• https://t.me/cvenotify/72308 · Telegram Post
• https://t.me/cibsecurity/67109 · Telegram Post