CVE-2023-25841
Medium
Description
There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Mitigation: Disable anonymous access to ArcGIS Feature services with edit capabilities.
SeverityMedium
CVSS6.1
Exploit probability—
ProductEsri Arcgis Server
PublishedJul 21, 2023
First seenJul 21, 2023
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- esri arcgis_server11.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| esri arcgis_server | 10.8.1 ≤ v < 11.1 | 11.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.