| Package | Affected versions | Patched versions |
|---|---|---|
| arcgis server | ≥ 10.8.1, < 11.1 | 11.1 |
There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Mitigation: Disable anonymous access to ArcGIS Feature services with edit capabilities.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free