CVE-2022-38190: Stored cross-site scripting vulnerability in Esri Portal for ArcGIS Configurable Apps
Published Aug 15, 2022
·Updated
A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS configurable apps may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser
Affected Software
1 affected component
Esri Portal for ArcGIS<=10.8.1
Remediation
Information
Install Portal for ArcGIS 2022 Security Update 1
Event History
Aug 15, 2022
CVE Published
via MITRE·08:45 PM
Data Sourced
via MITRE·08:45 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2022-38190.
2
What is the severity level of CVE-2022-38190?
The severity level of CVE-2022-38190 is medium (6.1).
3
What software is affected by CVE-2022-38190?
Esri Portal for ArcGIS version 10.8.1 is affected by CVE-2022-38190.
4
What is the Common Weakness Enumeration (CWE) ID of CVE-2022-38190?
The CWE ID of CVE-2022-38190 is CWE-79.
5
Is CVE-2022-38190 a Cross Site Scripting (XSS) vulnerability?
Yes, CVE-2022-38190 is a stored Cross Site Scripting (XSS) vulnerability.