A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser.
References
Configurations
Configuration 1 (hide)
|
History
31 Oct 2022, 13:40
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-79 | |
First Time |
Esri
Esri arcgis Server |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
CPE | cpe:2.3:a:esri:arcgis_server:10.7.1:*:*:*:*:*:*:* cpe:2.3:a:esri:arcgis_server:10.8.1:*:*:*:*:*:*:* |
|
References | (CONFIRM) https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-map-service-security-2022-update-1-is-now-available - Broken Link |
25 Oct 2022, 17:37
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-10-25 17:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-38200
Mitre link : CVE-2022-38200
CVE.ORG link : CVE-2022-38200
JSON object : View
Products Affected
esri
- arcgis_server
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')