CVE-2023-25840 (published 2023-07-21T18:37:34.431Z)

There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 10.8.1 – 11.1 that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser.  The privileges required to execute this attack are high.




Affected products: Vendor: Esri
Product: Server
Versions: 10.8.1