PT-2022-24269 · Esri · Esri Portal For Arcgis

Published 2022-08-15 · Updated 2023-06-27 · CVE-2022-38191

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions 10.9.0 and below

Description The issue is an HTML injection problem that may allow a remote, authenticated attacker to inject HTML into some locations in the home application. This could potentially be exploited by attackers to manipulate the application's behavior or display malicious content.

Recommendations For Esri Portal for ArcGIS versions 10.9.0 and below, consider restricting access to the home application until a patch is available. As a temporary workaround, disabling the ability to inject HTML into the application may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

XSS

Weakness Enumeration

CWE-74

CWE-79

Related Identifiers

CVE-2022-38191

Affected Products

Esri Portal For Arcgis

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-38191 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38191 · Vendor Advisory
• https://esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch · Vendor Advisory
• https://t.me/cvenotify/34721 · Telegram Post
• https://t.me/cibsecurity/48193 · Telegram Post
• https://t.me/cvenotify/34700 · Telegram Post