Vulnerability Details : CVE-2022-38208

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

Vulnerability category: Open redirect

Published 2022-12-29 20:15:10

Updated 2023-01-05 22:09:21

Source Environmental Systems Research Institute, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-38208

Probability of exploitation activity in the next 30 days: 0.07%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 28 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2022-38208

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	nvd@nist.gov
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	psirt@esri.com
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2022-38208

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

Assigned by: psirt@esri.com (Primary)

References for CVE-2022-38208

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available

Portal for ArcGIS Security 2022 Update 2 Patch is Now Available
Vendor Advisory

CVEs referencing this url

Products affected by CVE-2022-38208

Esri » Portal For Arcgis
Versions up to, including, (<=) 11.0
cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*
Matching versions