Esri ArcGIS Web AppBuilder HTML Injection Vulnerability

A vulnerability allowing HTML injection has been identified in Esri ArcGIS Web AppBuilder Developer Edition, versions prior to 2.30. This issue enables a remote, unauthenticated attacker to potentially lure a user into clicking a link that renders arbitrary HTML in the user's browser. Although this vulnerability does not allow for JavaScript execution, which would have increased its impact, it still poses a risk by manipulating how content is displayed in the browser.

Impact

Exploitation of this vulnerability could lead to unauthorized HTML being rendered in a user's browser, potentially allowing for phishing attacks or other social engineering tactics. However, the lack of JavaScript execution limits the severity of this impact.