CVE-2024-25690

Summary

CVE-2024-25690 is a newly identified HTML injection vulnerability affecting Esri Portal for ArcGIS versions 11.1 and below. An attacker can exploit this weakness by creating a maliciously crafted link, which, when clicked, could cause the victim's browser to render arbitrary HTML code. The vulnerability is remote and does not require authentication, posing a significant risk to users. Successful exploitation could lead to various attacks, including phishing, cross-site scripting, and other forms of browser-based attacks. Users are strongly advised to update their Esri Portal for ArcGIS installations to the latest version to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.