Lucene search

[email protected]CVE-2022-38187

HistoryAug 15, 2022 - 9:15 p.m.

CVE-2022-38187

2022-08-1521:15:11

CWE-918

[email protected]

web.nvd.nist.gov

cve-2022-38187

esri

arcgis

security vulnerability

unauthenticated access

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

47.4%

JSON

Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs.

Affected configurations

NVD

Node

esriportal_for_arcgisRange<10.9

CPENameOperatorVersion
esri:portal_for_arcgisesri portal for arcgislt10.9

CPE	Name	Operator	Version
esri:portal_for_arcgis	esri portal for arcgis	lt	10.9

CNA Affected

[
  {
    "platforms": [
      "x64"
    ],
    "product": "Portal for ArcGIS",
    "vendor": "Esri",
    "versions": [
      {
        "lessThanOrEqual": "10.8.1",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  }
]

References

www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/

Social References

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

47.4%

JSON

Related for CVE-2022-38187

prion1 cvelist1 nvd1