CVE-2025-55107CWE-79

BUG-000177335 ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.

Medium · published August 21, 2025

CVSS v3.1
4.8
EPSS
0%
Percentile
12.1
In the wild
Unconfirmed
What it is

There is a stored

Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites

versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to

inject malicious a file with an embedded xss script which when loaded could

potentially execute arbitrary JavaScript code in the victim’s browser. The

privileges required to execute this attack are high. The attack could

disclose a privileged token which may result in the attacker gaining full

control of the Portal.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00222 · 12.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-08-21T19:29Z
EPSS history
Timeline
  • 21 AUG 19:29Z
    BUG-000177335 ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.
    cvelistv5