CVE-2022-38206: Reflected XSS vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only)

Q: What is CVE-2022-38206?

CVE-2022-38206 is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below.

Q: How does CVE-2022-38206 affect Esri Portal for ArcGIS?

CVE-2022-38206 allows a remote attacker to create a crafted link that, when clicked, could execute arbitrary JavaScript code in the victim's browser.

Q: How severe is CVE-2022-38206?

CVE-2022-38206 has a severity rating of medium with a CVSS score of 6.1.

Q: What is the affected software for CVE-2022-38206?

Esri Portal for ArcGIS versions 10.9.1 and below are affected by CVE-2022-38206.

Q: How can I fix CVE-2022-38206?

To fix CVE-2022-38206, it is recommended to update Esri Portal for ArcGIS to the latest version available.

Published Dec 29, 2022

Updated

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote remote, unauthenticated attacker to create a crafted link which when clicked could execute arbitrary JavaScript code in the victim’s browser.

Affected Software

1 affected component

Esri Portal for ArcGIS<=10.9.1

Event History

Dec 29, 2022

CVE Published

08:15 PM

Dec 30, 2022

CVE Published

via MITRE·05:13 AM

Data Sourced

via MITRE·05:13 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2022-38206?

CVE-2022-38206 is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below.

How does CVE-2022-38206 affect Esri Portal for ArcGIS?

CVE-2022-38206 allows a remote attacker to create a crafted link that, when clicked, could execute arbitrary JavaScript code in the victim's browser.

How severe is CVE-2022-38206?