Esri ArcGIS Pro Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Esri ArcGIS Pro versions 3.6.0 and earlier. This issue allows a local attacker to inject malicious strings into ArcGIS Pro, which may be executed when a specific dialog is opened. The vulnerability has been addressed in ArcGIS Pro version 3.6.1.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to ArcGIS Pro version 3.6.1 to address this vulnerability. This patch is available through the ArcGIS Pro Updater or MyEsri.