CVE-2024-25692: falha de média gravidade em Esri Portal for ArcGIS
BUG-000154722 - Cross-site request forgery (CSRF) issue in Portal for ArcGIS
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.2%
There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.1 and below that may in some cases allow a remote, unauthenticated attacker to trick an authorized user into executing unwanted actions via a crafted form. The impact to Confidentiality and Integrity vectors is limited and of low severity.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Produtos afetados
Esri · Portal for ArcGISCVEs relacionadas — Esri Portal for ArcGIS
No mesmo produto, das mais perigosas para as menos.
CVE-2024-25693CRITICALPortal for ArcGIS has a directory traversal vulnerability.EPSS 1.3%CVE-2022-38184HIGHThere is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1EPSS 1.0%CVE-2022-38193MEDIUMCode injection issue in Portal for ArcGIS (10.7.1 and 10.8.1)EPSS 0.9%CVE-2026-13019CRITICALMissing AuthenticationEPSS 0.8%CVE-2021-29108HIGHThere is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below.EPSS 0.8%CVE-2022-38203HIGHThe allowedProxyHosts property is not fully honored in ArcGIS Enterprise (10.8.1 and 10.7.1 only)EPSS 0.8%