VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 21, 2023· Updated Apr 10, 2025

BUG-000154070 Stored XSS issue in the ArcGIS REST Services directory

CVE-2023-25840

Description

There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser.  The privileges required to execute this attack are high.

Affected products

2
  • Esri/Arcgis Serverllm-fuzzy2 versions
    <=11.1+ 1 more
    • (no CPE)range: <=11.1
    • (no CPE)range: All

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.