CVE-2023-25834

MEDIUM

Portal for ArcGIS 10.7.1-10.9.1 - Improper Privilege Management

Title source: llm

Description

Changes to user permissions in Portal for ArcGIS 10.9.1 and below are incompletely applied in specific use cases. This issue may allow users to access content that they are no longer privileged to access.

References (2)

Core 2

Core References

Patch, Release Notes

https://support.esri.com/en-us/patches-updates/2023/portal-for-arcgis-security-2023-update-1-patch-8095

Patch, Vendor Advisory

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2023-update-1-patch-is-now-available/

Scores

CVSS v3 5.4

EPSS 0.0012

EPSS Percentile 30.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-269

Status published

Products (1)

esri/portal_for_arcgis 10.7.1 - 10.9.1

Published May 09, 2023

Tracked Since Feb 18, 2026