Esri ArcGIS Server Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Esri ArcGIS Server versions 11.3 and prior. This vulnerability allows a remote, authenticated attacker with publisher capabilities to create a crafted link that, when clicked, could execute arbitrary JavaScript in the victim's browser. The vulnerability has a low impact on confidentiality and integrity, with no effect on availability.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users are advised to update to ArcGIS Server Security 2025 Update 1, which is available through the Esri Support website.