Skip to content
OpenAdvisories
High WID-SEC-2023-1674 3 CVEs

ESRI ArcGIS: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Published Jul 5, 2023 · Updated Jul 5, 2023 · de-DE

Vendor: Esri Product: ArcGIS Enterprise Portal Sites < 11.1 Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in ESRI ArcGIS ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

ArcGIS ist ein Geoinformationssystem.

Vulnerabilities 3

  • High 8.4
    CVE-2023-25835

    BUG-000153659 ArcGIS Enterprise Sites has a stored XSS vulnerability

    There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that may allow a remote, authenticated attacker with high‑privileged access to create a crafted link that is persisted within the site configura…

    Esri Portal for ArcGIS Sites
  • High 8.4
    CVE-2023-25837

    BUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS.

    There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could result in the execution of arbitrary Ja…

    Esri Portal for ArcGIS Sites
  • Medium 5.4
    CVE-2023-25836

    BUG-000135364 XSS in 10.8.1 sites builder iframe source

    There is a Cross-site Scripting vulnerability in Esri Portal for ArcGIS Sites in versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the vic…

    Esri Portal for ArcGIS Sites

Revision history

  1. #1

    Initiale Fassung

References

  • ArcGIS Trust Center vom 2023-07-05
    https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-enterprise-sites-security-patch-is-now-available/