CVE-2024-25697

{"id": "CVE-2024-25697", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@esri.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2024-04-04T18:15:11.027", "references": [{"url": "https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/", "tags": ["Vendor Advisory"], "source": "psirt@esri.com"}, {"url": "https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@esri.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "There is a Cross-site Scripting vulnerability\u00a0in Portal for ArcGIS in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which when opening an authenticated users bio page will render an image in the victims browser. \u00a0The privileges required to execute this attack are low."}, {"lang": "es", "value": "Existe una vulnerabilidad de Cross-Site Scripting en Portal for ArcGIS en versiones <= 11.1 que puede permitir que un atacante remoto y autenticado cree un enlace manipulado que, al abrir la p\u00e1gina de biograf\u00eda de un usuario autenticado, mostrar\u00e1 una imagen en el navegador de la v\u00edctima. Los privilegios necesarios para ejecutar este ataque son bajos."}], "lastModified": "2025-04-10T19:15:57.740", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "078945E5-0E7F-4FC3-BA84-F2D9E215AE8F", "versionEndIncluding": "11.1"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@esri.com"}