CVE-2022-38209: Reflected XSS vulnerability in Portal for ArcGIS
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could execute arbitrary JavaScript code in the victim’s browser.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-38209?
CVE-2022-38209 is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below.
How does CVE-2022-38209 affect Esri Portal for ArcGIS?
CVE-2022-38209 allows a remote, unauthenticated attacker to create a crafted link which when clicked could execute arbitrary JavaScript code in the victim's browser.
What is the severity of CVE-2022-38209?
CVE-2022-38209 has a severity rating of medium, with a CVSS score of 6.1.
How can I fix CVE-2022-38209?
To fix CVE-2022-38209, update Esri Portal for ArcGIS to version 10.9.2 or above, as this vulnerability has been addressed in the security update patch.
Where can I find more information about CVE-2022-38209?
You can find more information about CVE-2022-38209 in the official Esri Portal for ArcGIS Security Update 2 Patch available at the following link: [https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available].