PT-2025-23199 · Esri · Esri Portal For Arcgis

Published 2025-05-28 · Updated 2025-12-15 · CVE-2025-4967

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions 11.4 and prior

Description The issue allows a remote, unauthenticated attacker to bypass the Portal’s Server Side Request Forgery (SSRF) protections. This enables the attacker to potentially exploit the system.

Recommendations For Esri Portal for ArcGIS versions 11.4 and prior, update to a version that includes the security patch for this issue, as provided in the 2025 update 2 patch.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2025-13109

CVE-2025-4967

Affected Products

Esri Portal For Arcgis

References · 13

• https://osv.dev/vulnerability/CVE-2025-4967 · Vendor Advisory
• https://esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-2-patch · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13109 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-4967 · Security Note
• https://twitter.com/SpaceCyberSec/status/1928542138738028591 · Twitter Post
• https://t.me/cvetracker/24931 · Telegram Post
• https://esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch · Note
• https://twitter.com/CveFindCom/status/1928182128421765453 · Twitter Post
• https://t.me/cveNotify/145821 · Telegram Post
• https://twitter.com/0dayPublishing/status/2000659743124107372 · Twitter Post
• https://twitter.com/threatsbank/status/1928346319191527914 · Twitter Post
• https://twitter.com/CVEnew/status/1928184017217634326 · Twitter Post
• https://t.me/latest_high_impact_cve/2493 · Telegram Post