CVE-2024-25694

Summary

CVE-2024-25694 is a stored Cross-site Scripting (XSS) vulnerability affecting Esri Portal for ArcGIS Enterprise versions 10.8.1 to 10.9.1. This issue allows a remote, authenticated attacker to craft malicious links and store them in the Layer Showcase application configuration. When users click on these links, they may unknowingly execute arbitrary JavaScript code in their browsers, potentially leading to the disclosure of privileged tokens. The attacker could leverage these tokens to gain full control of the vulnerable Portal. This vulnerability requires high privileges for exploitation.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.