Lucene search

EsriCVE-2022-38192

HistoryAug 16, 2022 - 5:15 p.m.

CVE-2022-38192

2022-08-1617:15:07

CWE-79

Esri

web.nvd.nist.gov

esri

portal for arcgis

xss

vulnerability

remote attacker

javascript code

nvd

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

29.2%

JSON

A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.

Affected configurations

Nvd

Node

esriportal_for_arcgisRange≤10.8.1

VendorProductVersionCPE
esriportal_for_arcgis*cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
esri	portal_for_arcgis	*	cpe:2.3:a:esri:portal_for_arcgis::::::::

CNA Affected

[
  {
    "platforms": [
      "x64"
    ],
    "product": "Portal for ArcGIS",
    "vendor": "Esri",
    "versions": [
      {
        "lessThanOrEqual": "10.8.1",
        "status": "affected",
        "version": "All",
        "versionType": "custom"
      }
    ]
  }
]

References

www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/

Social References

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

29.2%

JSON

Related for CVE-2022-38192