Lucene search

EsriCVE-2022-38208

HistoryDec 30, 2022 - 5:13 a.m.

CVE-2022-38208

2022-12-3005:13:00

CWE-601

Esri

web.nvd.nist.gov

cve-2022-38208

esri portal

arcgis 11

vulnerability

unvalidated redirect

nvd

security

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

44.9%

JSON

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

Affected configurations

Nvd

Node

esriportal_for_arcgisRange≤11.0

VendorProductVersionCPE
esriportal_for_arcgis*cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
esri	portal_for_arcgis	*	cpe:2.3:a:esri:portal_for_arcgis::::::::

CNA Affected

[
  {
    "vendor": "Esri",
    "product": "ArcGIS Enterprise",
    "versions": [
      {
        "version": "Portal for ArcGIS",
        "status": "affected",
        "lessThanOrEqual": "11.0",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "x64"
    ]
  }
]

References

www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

44.9%

JSON

Related for CVE-2022-38208