CVE-2022-38204: Reflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)

Published Dec 29, 2022

Updated

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.

Affected Software

2 affected components

Esri Portal for ArcGIS=10.7.1

Esri Portal for ArcGIS=10.8.1

Event History

Dec 29, 2022

CVE Published

08:15 PM

Dec 30, 2022

CVE Published

via MITRE·05:13 AM

Data Sourced

via MITRE·05:13 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2022-38204?

CVE-2022-38204 is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1.

How does CVE-2022-38204 impact Esri Portal for ArcGIS?

CVE-2022-38204 may allow a remote, unauthenticated attacker to create a crafted link that, when clicked, could potentially execute arbitrary JavaScript code in the victim's browser.

Which versions of Esri Portal for ArcGIS are affected by CVE-2022-38204?

Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 are affected by CVE-2022-38204.

What is the severity of CVE-2022-38204?

CVE-2022-38204 has a severity level of medium (6.1).

How can I fix CVE-2022-38204 in Esri Portal for ArcGIS?

To fix CVE-2022-38204, you should apply the security update patch provided by Esri Portal for ArcGIS.