Lucene search

[email protected]CVE-2022-38193

HistoryAug 16, 2022 - 5:15 p.m.

CVE-2022-38193

2022-08-1617:15:08

CWE-95

CWE-94

[email protected]

web.nvd.nist.gov

esri portal

arcgis

code injection

vulnerability

remote attack

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

67.8%

JSON

There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings which could potentially cause arbitrary code execution.

Affected configurations

NVD

Node

esriportal_for_arcgisRange≤10.8.1

CPENameOperatorVersion
esri:portal_for_arcgisesri portal for arcgisle10.8.1

CPE	Name	Operator	Version
esri:portal_for_arcgis	esri portal for arcgis	le	10.8.1

CNA Affected

[
  {
    "platforms": [
      "x64"
    ],
    "product": "Portal for ArcGIS",
    "vendor": "Esri",
    "versions": [
      {
        "status": "affected",
        "version": "10.7.1 10.8.1"
      }
    ]
  }
]

References

www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/

Social References

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

67.8%

JSON

Related for CVE-2022-38193

prion1 nvd1 cvelist1