« Volver al listado

CVE-2025-57875

Estado: AnalizadaMedia (4.8)—

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Esri — Portal FOR Arcgis

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-57875",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-57875",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-09-29T20:00:01.089720Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@esri.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@esri.com",
      "affectedData": [
        {
          "vendor": "Esri",
          "product": "Portal for ArcGIS",
          "versions": [
            {
              "status": "affected",
              "version": "10.9.1",
              "versionType": "custom",
              "lessThanOrEqual": "11.4"
            }
          ],
          "platforms": [
            "Windows",
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-09-29T19:15:36.560",
  "references": [
    {
      "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@esri.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@esri.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the  browser."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de scripting entre sitios reflejado en Esri Portal for ArcGIS 11.4 y versiones anteriores que puede permitir a un atacante remoto autenticado con acceso administrativo suministrar una cadena diseñada que ejecutaría código JavaScript arbitrario en el navegador."
    }
  ],
  "lastModified": "2026-09-30T23:10:00.237",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43F37C65-CBEC-4688-8DB4-B58C83EEBC92"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A97FDB6F-0614-4F4A-91F1-09C230ED5E3C"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7770A56F-0801-4982-828E-F43446224608"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A62FCB5-12A6-487C-BCA9-0AD3F11354CD"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57DA68A3-0E09-4C8C-A98E-B027964FA17A"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3A6B038-6C92-4A34-B980-E3872265FF89"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4DA6D70E-60D6-4CE6-AFA4-7BB191A23E3B"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FCD40AD-6D5B-498C-AFD7-B84B4FD1E3F3"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E2AE6CA-0F8E-4D40-94E3-FEAB2E7E2CF7"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3460737E-3181-4FCB-9A2B-D4C27C5FC774"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E56FFF86-E366-4910-8ECB-9F93F903762F"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F299D739-C8EA-4BEC-A356-3ED7F49A9A3B"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B46D70A-E101-407D-B326-034232260364"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "021904ED-87FD-4FB4-BCC8-DE89DB05FB66"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CF8719BA-95F6-4AB6-8A86-6742BE828260"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C19F9C7-F687-4865-8535-2E99E0AB0157"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC7EED3B-056E-4B86-94E4-FF0B62E376CA"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "532CBBBF-BB12-483C-A996-A7DE7F0330A9"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "967840A2-98F6-4729-B979-32628AA34F38"
            },
            {
              "criteria": "cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "278C5760-3183-4A79-BE1F-A280BD5A3274"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@esri.com"
}