CVE-2024-25694

CVSS V2 None CVSS V3 None

Description

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise versions 10.8.1 – 10.9.1 that may allow a remote, authenticated attacker to create a crafted link that is stored in the Layer Showcase application configuration which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.

Overview

CVE ID
CVE-2024-25694

Assigner
Esri

Vulnerability Status
PUBLISHED

Published Version
2024-10-04T17:17:58.818Z

Last Modified Date
2024-10-04T17:59:21.086Z

Weakness Enumerations

CWE	URL
CWE-79	http://cwe.mitre.org/data/definitions/79.html

References

Reference URL	Reference Tags
https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-25694
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25694

History

Created	Old Value	New Value	Data Type	Notes
2024-10-07 04:09:53				Added to TrackCVE