CVE-2023-25836CWE-79

BUG-000135364 XSS in 10.8.1 sites builder iframe source

Medium · published July 21, 2023

CVSS v3.1
5.4
EPSS
0%
Percentile
37.1
In the wild
Unconfirmed
What it is

There is a Cross-site Scripting vulnerability in Esri Portal for ArcGIS Sites in versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victims browser.  The privileges required to execute this attack are low.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00439 · 37.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-07-21T03:41Z
EPSS history
Timeline
  • 21 JUL 03:41Z
    BUG-000135364 XSS in 10.8.1 sites builder iframe source
    cvelistv5