Esri Portal for ArcGIS Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Esri Portal for ArcGIS versions 11.4 and earlier. This vulnerability allows a remote authenticated attacker with administrative privileges to inject a crafted string that executes arbitrary JavaScript in the victim's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute malicious scripts in the context of the user's browser session.

Remediation

Esri has released a security patch for Portal for ArcGIS in 2025 Update 3. This patch addresses this vulnerability and should be applied as soon as possible. Instructions for downloading the patch are available on the Esri Support website.