CVE-2023-25834

Changes to user permissions in Portal for ArcGIS 10.9.1 and below are incompletely applied in specific use cases. This issue may allow users to access content that they are no longer privileged to access.

Score

CVSS 3.1 5.4 Medium

Status

Modified - psirt@esri.com

Published

2023-05-09

Last modified

2025-04-10

Weaknesses

CWE-269

Affected products

• Portal For Arcgis (Esri)

References

• https://support.esri.com/en-us/patches-updates/2023/portal-for-arcgis-security-2023-update-1-patch-8095
• https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2023-update-1-patch-is…