Lucene search

EsriCVE-2022-38194

HistoryAug 16, 2022 - 5:15 p.m.

CVE-2022-38194

2022-08-1617:15:08

CWE-311

Esri

web.nvd.nist.gov

cve-2022-38194

esri

arcgis

encryption

information security

nvd

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

Percentile

5.1%

JSON

In Esri Portal for ArcGIS versions 10.8.1, a system property is not properly encrypted. This may lead to a local user reading sensitive information from a properties file.

Affected configurations

Nvd

Node

esriportal_for_arcgisMatch10.8.1

VendorProductVersionCPE
esriportal_for_arcgis10.8.1cpe:2.3:a:esri:portal_for_arcgis:10.8.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
esri	portal_for_arcgis	10.8.1	cpe:2.3:a:esri:portal_for_arcgis:10.8.1:::::::*

CNA Affected

[
  {
    "platforms": [
      "x64"
    ],
    "product": "Portal for ArcGIS",
    "vendor": "Esri",
    "versions": [
      {
        "status": "affected",
        "version": "10.8.1"
      }
    ]
  }
]

References

www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/

Social References

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2022-38194