CVE-2022-38184highCWE-284

CVE-2022-38184: high-severity vulnerability in Esri Portal for ArcGIS

There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1

Published · Updated

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.0%
exploitation probability
1.0%top 37% of all CVEs
observed exploitation
nono source reports it
In short

Portal for ArcGIS versions 10.8.1 and below have a flaw that lets unauthorized attackers access an API without logging in, which can trick the system into reading files or content from any URL an attacker specifies.

Technical detail

This improper access control vulnerability (CWE-284) in Portal for ArcGIS ≤10.8.1 allows unauthenticated remote attackers to access an unprotected API endpoint that enables Server-Side Request Forgery (SSRF). The attack requires no prior authentication and can result in arbitrary URL fetching by the affected application, potentially exposing internal resources or sensitive data.

Summary generated and translated by AI from the official description.
There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Esri · Portal for ArcGIS
Related CVEs — Esri Portal for ArcGIS

In the same product, most dangerous first.

CVE-2024-25693CRITICALPortal for ArcGIS has a directory traversal vulnerability.EPSS 1.3%CVE-2022-38193MEDIUMCode injection issue in Portal for ArcGIS (10.7.1 and 10.8.1)EPSS 0.9%CVE-2026-13019CRITICALMissing AuthenticationEPSS 0.8%CVE-2021-29108HIGHThere is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below.EPSS 0.8%CVE-2022-38203HIGHThe allowedProxyHosts property is not fully honored in ArcGIS Enterprise (10.8.1 and 10.7.1 only)EPSS 0.8%CVE-2021-29109MEDIUMA reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9.EPSS 0.7%
References
https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/