CVE-2023-25832 HIGH

CVE-2023-25832: BUG-000148346 There is a Cross-Site Request Forgery (CSRF) vulnerability in Portal for ArcGIS.

Vendor Esri

Product Portal for ArcGIS

Weakness CWE-352 · CSRF

Published May 9, 2023

Last update April 10, 2025

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an attacker to trick an authorized user into executing unwanted actions.

Key dates

02Disclosure timeline

May 9, 2023 CVE published

April 10, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-25832 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html

Related vulnerabilities

04Related CVE

CVE-2025-28857 WordPress Rankchecker.io Integration plugin <= 1.0.9 - CSRF to Stored Cross Site Scripting (XSS) vulnerability CVE-2023-40198 WordPress Easy Cookie Law Plugin <= 3.1 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2026-41074 RT has broken CSRF protection for authenticated users CVE-2018-25186 Tina4 Stack 1.0.3 Cross-Site Request Forgery via profile CVE-2025-31400 WordPress WS Audio Player plugin <= 1.1.8 - CSRF to Stored XSS vulnerability