VULNERABILITY INTELLIGENCE

CVE-2024-25705

CVSS score5.4 MEDIUM
EPSS probability0.47%
CISA KEVNot currently listed
Published2024-04-04
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

There is a cross‑site scripting (XSS) vulnerability in Esri Portal for ArcGIS Experience Builder versions 11.1 and below on Windows and Linux that allows a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary JavaScript code in the victim’s browser. Exploitation requires basic authenticated access but does not require elevated or administrative privileges, indicating low privileges are required.

Weakness classification

  • psirt@esri.com: CWE-79

Primary references