CVE-2023-25837: BUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS.

Vulnerability summary

CVE-2023-25837 is a high (CVSS 8.4) Cross-site Scripting vulnerability in esri portal_for_arcgis. EPSS estimates a 0.99% chance of exploitation in the next 30 days, higher than 62.2% of scored vulnerabilities.

Timeline

1. 21-07-2023
   PublishedVulnerability first disclosed.
2. 06-02-2026
   Last modifiedVulnerability information updated.

Description

There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could result in the execution of arbitrary JavaScript code in the target’s browser. Exploitation requires high‑privileged authenticated access. Successful exploitation may allow the attacker to access sensitive session data, manipulate trusted content, and disrupt normal application functionality, resulting in a high impact to confidentiality, integrity, and availability.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.