CVE-2025-57879
BaseFortify
Publication date: 2025-09-29
Last updated on: 2025-10-17
Assigner: Environmental Systems Research Institute, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| esri | portal_for_arcgis | 10.9.1 |
| esri | portal_for_arcgis | 10.9.1 |
| esri | portal_for_arcgis | 10.9.1 |
| esri | portal_for_arcgis | 11.0 |
| esri | portal_for_arcgis | 11.1 |
| esri | portal_for_arcgis | 11.1 |
| esri | portal_for_arcgis | 11.1 |
| esri | portal_for_arcgis | 11.1 |
| esri | portal_for_arcgis | 11.1 |
| esri | portal_for_arcgis | 11.2 |
| esri | portal_for_arcgis | 11.2 |
| esri | portal_for_arcgis | 11.2 |
| esri | portal_for_arcgis | 11.2 |
| esri | portal_for_arcgis | 11.2 |
| esri | portal_for_arcgis | 11.3 |
| esri | portal_for_arcgis | 11.3 |
| esri | portal_for_arcgis | 11.3 |
| esri | portal_for_arcgis | 11.4 |
| esri | portal_for_arcgis | 11.4 |
| esri | portal_for_arcgis | 11.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-601 | The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an unvalidated redirect issue in Esri Portal for ArcGIS versions 11.4 and below. It allows a remote, unauthenticated attacker to craft a URL that redirects a victim to an arbitrary website, which can be used to facilitate phishing attacks.
How can this vulnerability impact me? :
The vulnerability can impact you by enabling attackers to redirect users to malicious websites through crafted URLs. This can simplify phishing attacks, potentially leading to credential theft, malware infection, or other security breaches.
What immediate steps should I take to mitigate this vulnerability?
Apply the Portal for ArcGIS Enterprise Security 2025 Update 3 Patch released on September 15, 2025, which addresses this vulnerability among others. This patch is cumulative and does not require prior patch installations. Additionally, upgrade to version 11.5 or above if possible, as these versions are not vulnerable. Implement the 2025 Top 3 New Critical Security Recommendations provided by Esri to enhance overall security posture. [1]