CVE-2024-25701

Summary

CVE-2024-25701 is a stored Cross-site Scripting (XSS) vulnerability affecting Esri Portal for ArcGIS Enterprise Experience Builder versions 10.8.1 to 11.1. This issue enables a remote, authenticated attacker to create a malicious link containing JavaScript code, which, when loaded in the Experience Builder Embed widget, could execute arbitrary scripts in the victim's browser. Successful exploitation may result in the disclosure of a privileged token, potentially granting the attacker full control of the Portal. The attacker requires high privileges to execute this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.