CVE-2022-38211: high-severity vulnerability in Esri ArcGIS Enterprise
Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Portal for ArcGIS fails to properly block Server-Side Request Forgery attacks, allowing an unauthenticated attacker to make the server request arbitrary URLs. This can expose internal network resources or sensitive information that should not be accessible from outside.
An unauthenticated remote attacker can bypass SSRF protections in Portal for ArcGIS (versions 10.9.1 and below) to forge HTTP requests from the vulnerable server to arbitrary URLs. This enables network reconnaissance and potential exfiltration of data from internal hosts, with CVSS score of 7.5 indicating significant network impact.
In the same product, most dangerous first.