CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-38204 – Reflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only)
https://notcve.org/view.php?id=CVE-2022-38204
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Hay una vulnerabilidad XSS reflejada en Esri Portal for ArcGIS versiones 10.8.1 y 10.7.1 que puede permitir que un atacante remoto no autenticado cree un enlace manipulado que, al hacer clic, podría ejecutar código JavaScript arbitrario en el navegador de la víctima. • https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38203 – The allowedProxyHosts property is not fully honored in ArcGIS Enterprise (10.8.1 and 10.7.1 only)
https://notcve.org/view.php?id=CVE-2022-38203
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212. Las protecciones contra posibles vulnerabilidades de Server-Side Request Forgery (SSRF) en Esri Portal for ArcGIS versiones 10.8.1 e inferiores no se respetaron en su totalidad y pueden permitir que un atacante remoto y no autenticado falsifique solicitudes a URL arbitrarias desde el sistema, lo que podría provocar una enumeración de la red. o lectura desde hosts dentro del perímetro de la red, un problema diferente a CVE-2022-38211 y CVE-2022-38212. • https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2022-update-2-patch-is-now-available • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38202 – BUG-000152121 - Directory traversal vulnerability in ArcGIS Server.
https://notcve.org/view.php?id=CVE-2022-38202
There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker traverse the file system to access files outside of the intended directory on ArcGIS Server. This could lead to the disclosure of sensitive site configuration information (not user datasets). Existe una vulnerabilidad de path traversal en las versiones 10.9.1 y anteriores de Esri ArcGIS Server. La explotación exitosa puede permitir que un atacante remoto y no autenticado atraviese el sistema de archivos para acceder a archivos fuera del directorio previsto en ArcGIS Server. • https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2022-update-2-patch-is-now-available • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38201 – An unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.
https://notcve.org/view.php?id=CVE-2022-38201
An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker can potentially induce an unsuspecting authenticated user to access an an attacker controlled domain. Existe una vulnerabilidad de redireccionamiento no validada en Esri Portal for ArcGIS Quick Capture Web Designer versiones 10.8.1 a 10.9.1. Un atacante remoto y no autenticado puede potencialmente inducir a un usuario autenticado desprevenido a acceder a un dominio controlado por un atacante. • https://www.esri.com/arcgis-blog/products/product/uncategorized/portal-for-arcgis-quick-capture-security-patch-is-now-available • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38195 – BUG-000150540 - Reflected XSS vulnerability in ArcGIS Server
https://notcve.org/view.php?id=CVE-2022-38195
There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser. Se presenta un problema de tipo cross site scripting reflejado en Esri ArcGIS Server versiones 10.9.1 y posteriores, que puede permitir a un atacante remoto no autorizado convencer a un usuario de que haga clic en un enlace diseñado que podría ejecutar código JavaScript arbitrario en el navegador de la víctima • https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •