Vulnerability Details CVE-2024-8149
There is a reflected Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 and 11.2 that may allow a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary JavaScript code in the victim’s browser. Exploitation is limited to the same browser execution context and does not result in a change of security scope beyond the affected user session.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 57.7%
CVSS Severity
CVSS v3 Score 4.6
Products affected by CVE-2024-8149
-
cpe:2.3:a:esri:portal_for_arcgis:11.1
-
cpe:2.3:a:esri:portal_for_arcgis:11.2