Description
There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
Mitigation: Disable anonymous access to ArcGIS Feature services with edit capabilities.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Esri | ArcGIS Enterprise Server | All – ≤ 11.1 | — |
Advisories 1
- WID-SEC-2023-1867 ESRI ArcGIS: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Jul 23, 2023