// For flags

CVE-2023-25840

BUG-000154070 Stored XSS issue in the ArcGIS REST Services directory

Severity Score

3.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 10.8.1 – 11.1 that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser.  The privileges required to execute this attack are high.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
None
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-02-15 CVE Reserved
  • 2023-07-21 CVE Published
  • 2024-07-27 EPSS Updated
  • 2024-10-08 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
  • CAPEC-63: Cross-Site Scripting (XSS)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Esri
Search vendor "Esri"
 Arcgis Server
Search vendor "Esri" for product "Arcgis Server"
 >= 10.8.1 < 11.1
Search vendor "Esri" for product "Arcgis Server" and version " >= 10.8.1 < 11.1"
-
Affected
in Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
--
Safe
Esri
Search vendor "Esri"
 Arcgis Server
Search vendor "Esri" for product "Arcgis Server"
 >= 10.8.1 < 11.1
Search vendor "Esri" for product "Arcgis Server" and version " >= 10.8.1 < 11.1"
-
Affected
in Microsoft
Search vendor "Microsoft"
 Windows
Search vendor "Microsoft" for product "Windows"
--
Safe