Is This Content Helpful?
How can we make this better? Please provide as much detail as possible.
Contact our Support Team
Be The First To Get Support Updates
Want to know about the latest technical content and software updates?
Bug: NIM092874: ArcGIS for Server 10.1 has a reflected non-persistent cross-site scripting vulnerability
Description
ArcGIS for Server 10.1 has a non-persistent cross-site scripting vulnerability.
CVE Reference
CVE-2013-5222 Various XSS Vulnerabilities
Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N Base Score 3.5
This vulnerability may be viewed as a standard entry in the Vulnerabilities and Exposures list.
Acknowledgements
Esri thanks the following for working with us to protect customers:
• Roberto Suggi Liverani of NCIA-NCIRC for reporting this vulnerability.
Cause
When certain URLs are provided, user-provided code can be inserted into ArcGIS for Server web pages.
Workaround
This issue is fixed in ArcGIS for Server 10.2. Esri recommends that customers upgrade to ArcGIS 10.2.
For those customers that cannot upgrade, Esri has released a security patch that addresses this and other security vulnerabilities that affect ArcGIS 10.1 SP1 for Server. Esri recommends that customers download and apply the 10.1 SP1 Security patch, which can be found here:
• ArcGIS 10.1 SP1 for Server Security Patch (September 2013)
Related Information
Last Published : 5/5/2016
Article ID: 000011849
Software: ArcGIS Image Server 10.1 ArcGIS Server 10.1 ArcGIS GeoEvent Server 10.1
Download the Esri Support App on your phone to receive notifications when new content is available for Esri products you use
Download the Esri Support App on your phone to receive notifications when new content is available for Esri products you use
