Low severity3.4NVD Advisory· Published Jul 21, 2023· Updated Jun 17, 2026
CVE-2023-25840
CVE-2023-25840
Description
There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser. The privileges required to execute this attack are high.
Affected products
3cpe:2.3:a:esri:arcgis_server:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:esri:arcgis_server:*:*:*:*:*:*:*:*range: >=10.8.1,<11.1
- (no CPE)range: <=11.1
- (no CPE)range: All
Patches
Vulnerability mechanics
References
1- www.esri.com/arcgis-blog/products/trust-arcgis/announcements/arcgis-server-security-2023-update-1-patch-available/nvdRelease NotesVendor Advisory
News mentions
0No linked articles in our index yet.