Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2024-38039

BUG-000161683 - HTML injection vulnerability in Portal for ArcGIS.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Esri

Description

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser (no stateful change made or customer data rendered).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Esri Portal for ArcGIS

Default version status: unaffected

  • 10.9.1affected
  • 11.1affected

References