Esri Arcgis Enterprise Server vulnerabilities
3 vulnerabilities
Known vulnerabilities in Esri Arcgis Enterprise Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
LowCVE-2023-25840esri · arcgis enterprise server +1 moreBUG-000154070 Stored XSS issue in the ArcGIS REST Services directoryThere is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser. The privileges required to execute this attack are high.EPSS0.48%MediumCVE-2023-25841esri · arcgis enterprise server +1 moreBUG-000158075 Stored XSS issue in ArcGIS ServerThere is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
Mitigation: Disable anonymous access to ArcGIS Feature services with edit capabilities.EPSS0.64%MediumCVE-2023-25848esri · arcgis enterprise server +1 moreBUG-000158039 - There is an information disclosure issue in ArcGIS Server.ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue.
The information disclosed is limited to a single attribute in a database connection string. No business data is disclosed.EPSS0.29%