CVE-2025-57872

MEDIUM

Esri Portal For Arcgis - Open Redirect

Title source: rule

Description

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

References (1)

[Patch, Vendor Advisory] https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch

Scores

CVSS v3 6.1

EPSS 0.0003

EPSS Percentile 10.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-601

Status published

Products (6)

esri/portal_for_arcgis 10.9.1 (3 CPE variants)

esri/portal_for_arcgis 11.0

esri/portal_for_arcgis 11.1 (5 CPE variants)

esri/portal_for_arcgis 11.2 (5 CPE variants)

esri/portal_for_arcgis 11.3 (3 CPE variants)

esri/portal_for_arcgis 11.4 (3 CPE variants)

Published Sep 29, 2025

Tracked Since Feb 18, 2026