VYPR
← All advisories
Medium severity4.8NVD Advisory· Published Apr 4, 2024· Updated Jun 17, 2026

CVE-2024-25708

CVE-2024-25708

Description

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high.

Affected products

4
  • Esri/Arcgis Enterprise2 versions
    cpe:2.3:a:esri:arcgis_enterprise:10.8.1:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:esri:arcgis_enterprise:10.8.1:*:*:*:*:*:*:*
    • cpe:2.3:a:esri:arcgis_enterprise:10.9.1:*:*:*:*:*:*:*
  • Esri/Portal for ArcGIS Enterprise Sitesllm-fuzzy
    Range: <=10.9.1
  • Esri/ArcGIS Enterprise Web App Builderv5
    Range: All

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.