CVE-2025-57879

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-09-29

Last updated on: 2025-10-17

Assigner: Environmental Systems Research Institute, Inc.

Description

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-09-29

Last Modified

2025-10-17

Generated

2026-07-06

AI Q&A

2025-09-29

EPSS Evaluated

2026-07-05

NVD

CVE-2025-57879

EUVD

EUVD-2025-31610

Affected Vendors & Products

Vendor	Product	Version / Range
esri	portal_for_arcgis	10.9.1
esri	portal_for_arcgis	10.9.1
esri	portal_for_arcgis	10.9.1
esri	portal_for_arcgis	11.0
esri	portal_for_arcgis	11.1
esri	portal_for_arcgis	11.1
esri	portal_for_arcgis	11.1
esri	portal_for_arcgis	11.1
esri	portal_for_arcgis	11.1
esri	portal_for_arcgis	11.2
esri	portal_for_arcgis	11.2
esri	portal_for_arcgis	11.2
esri	portal_for_arcgis	11.2
esri	portal_for_arcgis	11.2
esri	portal_for_arcgis	11.3
esri	portal_for_arcgis	11.3
esri	portal_for_arcgis	11.3
esri	portal_for_arcgis	11.4
esri	portal_for_arcgis	11.4
esri	portal_for_arcgis	11.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This vulnerability is an unvalidated redirect issue in Esri Portal for ArcGIS versions 11.4 and below. It allows a remote, unauthenticated attacker to craft a URL that redirects a victim to an arbitrary website, which can be used to facilitate phishing attacks.

Impact Analysis

The vulnerability can impact you by enabling attackers to redirect users to malicious websites through crafted URLs. This can simplify phishing attacks, potentially leading to credential theft, malware infection, or other security breaches.

Mitigation Strategies

Apply the Portal for ArcGIS Enterprise Security 2025 Update 3 Patch released on September 15, 2025, which addresses this vulnerability among others. This patch is cumulative and does not require prior patch installations. Additionally, upgrade to version 11.5 or above if possible, as these versions are not vulnerable. Implement the 2025 Top 3 New Critical Security Recommendations provided by Esri to enhance overall security posture. [1]

Hi! I’m here to help you understand CVE-2025-57879. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70