CVE-2024-25705 — Cross site scripting issue in embed widget

Description (CNA)

There is a cross‑site scripting (XSS) vulnerability in Esri Portal for ArcGIS Experience Builder versions 11.1 and below on Windows and Linux that allows a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary JavaScript code in the victim’s browser. Exploitation requires basic authenticated access but does not require elevated or administrative privileges, indicating low privileges are required.

Affected (CNA)

Vendor / product	Versions
Esri / Portal for ArcGIS	affected all through <=11.1

CWE

CWE-79

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/the-portal-for-arcgis-security-2024-update-2-is-available-install-these-patches-at-your-earliest-opportunity-to-address-these-vulnerabilities/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.