{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-24T11:34:18.456","vulnerabilities":[{"cve":{"id":"CVE-2024-25705","sourceIdentifier":"psirt@esri.com","published":"2024-04-04T18:15:12.603","lastModified":"2026-06-17T07:16:26.453","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"There is a cross‑site scripting (XSS) vulnerability in Esri Portal for ArcGIS Experience Builder versions 11.1 and below on Windows and Linux that allows a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary JavaScript code in the victim’s browser. Exploitation requires basic authenticated access but does not require elevated or administrative privileges, indicating low privileges are required."},{"lang":"es","value":"Existe una vulnerabilidad de Cross-site Scripting en Esri Portal for ArcGIS Experience Builder 11.1 y versiones anteriores en Windows y Linux que permite a un atacante remoto no autenticado crear un vínculo manipulado que, al hacer clic en él, podría ejecutar código JavaScript arbitrario en el navegador de la víctima. Los privilegios necesarios para ejecutar este ataque son bajos."}],"affected":[{"source":"psirt@esri.com","affectedData":[{"vendor":"Esri","product":"Portal for ArcGIS","defaultStatus":"unaffected","platforms":["Windows","Linux"],"versions":[{"version":"all","lessThanOrEqual":"<=11.1","versionType":"11.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@esri.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-04-05T15:44:19.667197Z","id":"CVE-2024-25705","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@esri.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*","versionEndIncluding":"11.1","matchCriteriaId":"078945E5-0E7F-4FC3-BA84-F2D9E215AE8F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"},{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/the-portal-for-arcgis-security-2024-update-2-is-available-install-these-patches-at-your-earliest-opportunity-to-address-these-vulnerabilities/","source":"psirt@esri.com","tags":["Vendor Advisory"]}]}}]}