PT-2025-12376 · Esri · Arcgis Enterprise

CVE-2025-2538

·

Publicado

2025-03-20

·

Atualizado

2025-12-10

CVSS v2.0

10

Crítica

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Esri ArcGIS Enterprise versions 10.9.1 through 11.4
Description A specific type of ArcGIS Enterprise deployment is vulnerable to a password recovery exploitation vulnerability in Portal, which could allow an attacker to reset the password on the built-in admin account. This issue could permit attackers to hijack built-in administrative accounts through a password reset flaw. The vulnerability is considered critical and could risk data breaches.
Recommendations For versions 10.9.1 through 11.4, consider disabling the password recovery feature in Portal until a patch is available. Restrict access to the administrative account to minimize the risk of exploitation. As a temporary workaround, limit the use of the built-in admin account until the issue is resolved.

Correção

Using Hardcoded Credentials

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

BDU:2025-14627
CVE-2025-2538

Produtos afetados

Arcgis Enterprise