PT-2024-21096 · Esri · Esri Portal For Arcgis

Published 2024-04-04 · Updated 2025-01-30 · CVE-2024-25698

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions 11.1 and below

Description The issue is a reflected cross site scripting vulnerability in the home application that allows a remote, unauthenticated attacker to create a crafted link. When clicked, this link could potentially execute arbitrary JavaScript code in the victim’s browser. This vulnerability affects Esri Portal for ArcGIS on both Windows and Linux platforms.

Recommendations For Esri Portal for ArcGIS versions 11.1 and below, update to a version above 11.1 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-25698

Affected Products

Esri Portal For Arcgis

References · 5

• https://osv.dev/vulnerability/CVE-2024-25698 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25698 · Security Note
• https://esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1775987556603068760 · Twitter Post
• https://t.me/cvenotify/109195 · Telegram Post