How severe is CVE-2022-38212?

CVE-2022-38212 has a severity level of high with a CVSS score of 7.5.

Which versions of Esri Portal for ArcGIS are affected by CVE-2022-38212?

Esri Portal for ArcGIS versions 10.8.1 and below are affected by CVE-2022-38212.

How can I fix CVE-2022-38212?

To fix CVE-2022-38212, it is recommended to update to the latest version of Esri Portal for ArcGIS and apply the necessary security patches provided by the vendor.

Where can I find more information about CVE-2022-38212?

You can find more information about CVE-2022-38212 in the following link: [https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available]

Vulnerability/
CVE-2022-38212

high

7.5

CWE

918

29/12/2022

30/12/2022

16/9/2024

CVE-2022-38212: Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)

Q: What is CVE-2022-38212?

CVE-2022-38212 is a vulnerability that allows a remote, unauthenticated attacker to forge requests to arbitrary URLs from the Esri Portal for ArcGIS system, potentially leading to network enumeration.

First published: Thu Dec 29 2022(Updated: )

Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38203.

Credit: psirt@esri.com

Affected Software	Affected Version	How to fix
Esri Portal for ArcGIS	<=10.8.1

Never miss a vulnerability like this again

Reference Links

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available

Frequently Asked Questions

What is CVE-2022-38212?
CVE-2022-38212 is a vulnerability that allows a remote, unauthenticated attacker to forge requests to arbitrary URLs from the Esri Portal for ArcGIS system, potentially leading to network enumeration.
How severe is CVE-2022-38212?
CVE-2022-38212 has a severity level of high with a CVSS score of 7.5.
Which versions of Esri Portal for ArcGIS are affected by CVE-2022-38212?
Esri Portal for ArcGIS versions 10.8.1 and below are affected by CVE-2022-38212.
How can I fix CVE-2022-38212?
To fix CVE-2022-38212, it is recommended to update to the latest version of Esri Portal for ArcGIS and apply the necessary security patches provided by the vendor.
Where can I find more information about CVE-2022-38212?
You can find more information about CVE-2022-38212 in the following link: [https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available]

collector/nvd-index
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/severity
agent/weakness
agent/references
agent/author
agent/description
agent/first-publish-date
agent/title
agent/tags
agent/event
vendor/esri
canonical/esri portal for arcgis
version/esri portal for arcgis/10.8.1

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.