CVE-2024-25694 - CVE House
Back to Database
Status published Medium CVE-2024-25694

BUG-000163019 - Stored XSS in Portal for ArcGIS

Vulnerability Description

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in the Layer Showcase application configuration which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-25694

Credits & Attribution

No credits recorded in the NVD database.

References

More from Esri

View All →
CVE-2025-67712
HTML injection issue in ArcGIS Web App Builder
Medium 4.7
CVE-2025-67711
Reflected XSS vulnerability in ArcGIS Server.
Medium 6.1
CVE-2025-67710
Stored XSS vulnerability in ArcGIS Server
Medium 6.1
CVE-2025-67709
There is a cross site scripting issue in ArcGIS Server.
Medium 6.1
CVE-2025-67708
Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server.
Medium 6.1

Affected Vendor

Affected Software

Enterprise Web App Builder
Vulnerable Versions:
all

Timeline

Official Publish: October 4th, 2024
Last Modified: April 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact