Lucene search

[email protected]CVE-2022-38194

HistoryAug 16, 2022 - 5:15 p.m.

CVE-2022-38194

2022-08-1617:15:08

CWE-311

[email protected]

web.nvd.nist.gov

cve-2022-38194

esri

arcgis

encryption

information security

nvd

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

5.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.2%

JSON

In Esri Portal for ArcGIS versions 10.8.1, a system property is not properly encrypted. This may lead to a local user reading sensitive information from a properties file.

Affected configurations

NVD

Node

esriportal_for_arcgisMatch10.8.1

CPENameOperatorVersion
esri:portal_for_arcgisesri portal for arcgiseq10.8.1

CPE	Name	Operator	Version
esri:portal_for_arcgis	esri portal for arcgis	eq	10.8.1

CNA Affected

[
  {
    "platforms": [
      "x64"
    ],
    "product": "Portal for ArcGIS",
    "vendor": "Esri",
    "versions": [
      {
        "status": "affected",
        "version": "10.8.1"
      }
    ]
  }
]

References

www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/

Social References

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

5.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.2%

JSON

Related for CVE-2022-38194

cvelist1 prion1 nvd1