CVE-2022-38208: falha de média gravidade em Esri ArcGIS Enterprise
Unvalidated redirect in Portal for ArcGIS
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.5%
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Esri · ArcGIS EnterpriseCVEs relacionadas — Esri ArcGIS Enterprise
No mesmo produto, das mais perigosas para as menos.
CVE-2022-38205HIGHPortal for ArcGIS has a directory traversal vulnerability (10.9.1, 10.8.1 and 10.7.1 only)EPSS 1.6%CVE-2022-38211HIGHServer Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only)EPSS 0.9%CVE-2022-38212HIGHServer Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)EPSS 0.8%CVE-2022-38204MEDIUMReflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)EPSS 0.5%CVE-2022-38210MEDIUMHTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only)EPSS 0.5%CVE-2022-38206MEDIUMReflected XSS vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only)EPSS 0.5%