« Volver al listado

CVE-2025-57874

Estado: AnalizadaMedia (4.8)—

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Esri — Portal FOR Arcgis

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-57874",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-57874",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-09-29T19:10:54.072055Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@esri.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@esri.com",
      "affectedData": [
        {
          "vendor": "Esri",
          "product": "Portal for ArcGIS",
          "versions": [
            {
              "status": "affected",
              "version": "10.9.1",
              "versionType": "custom",
              "lessThanOrEqual": "11.4"
            }
          ],
          "platforms": [
            "Windows",
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-09-29T19:15:36.400",
  "references": [
    {
      "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@esri.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@esri.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the  browser."
    }
  ],
  "lastModified": "2026-06-17T09:43:33.197",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43F37C65-CBEC-4688-8DB4-B58C83EEBC92"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A97FDB6F-0614-4F4A-91F1-09C230ED5E3C"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7770A56F-0801-4982-828E-F43446224608"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A62FCB5-12A6-487C-BCA9-0AD3F11354CD"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57DA68A3-0E09-4C8C-A98E-B027964FA17A"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3A6B038-6C92-4A34-B980-E3872265FF89"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4DA6D70E-60D6-4CE6-AFA4-7BB191A23E3B"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FCD40AD-6D5B-498C-AFD7-B84B4FD1E3F3"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E2AE6CA-0F8E-4D40-94E3-FEAB2E7E2CF7"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3460737E-3181-4FCB-9A2B-D4C27C5FC774"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E56FFF86-E366-4910-8ECB-9F93F903762F"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F299D739-C8EA-4BEC-A356-3ED7F49A9A3B"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B46D70A-E101-407D-B326-034232260364"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "021904ED-87FD-4FB4-BCC8-DE89DB05FB66"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CF8719BA-95F6-4AB6-8A86-6742BE828260"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C19F9C7-F687-4865-8535-2E99E0AB0157"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC7EED3B-056E-4B86-94E4-FF0B62E376CA"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "532CBBBF-BB12-483C-A996-A7DE7F0330A9"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "967840A2-98F6-4729-B979-32628AA34F38"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "278C5760-3183-4A79-BE1F-A280BD5A3274"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@esri.com"
}