CVE-2022-38197

Summary

Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter.

Affected Software

Weaknesses

• CWE-601: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

ADP Enrichment

CVE Program Container

Additional References

• https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch

• ←Previous
• Next→