Portal for ArcGIS vulnerabilities
22 known vulnerabilities in Portal for ArcGIS from Esri. 22 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
Portal for ArcGIS: Missing Authentication for Critical Functionality
A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
- 7.5 High severity
Portal for ArcGIS: Exposure of Sensitive Information to an Unauthorized Actor
There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.
- 7.5 High severity
Portal for ArcGIS: Exposure of Sensitive Information to an Unauthorized Actor
There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under difficult to reproduce circumstances allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.
- 9.8 Critical severity
Portal for ArcGIS: Weak Password Recovery Mechanism for Forgotten Password
A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcG
- 9.8 Critical severity
Portal for ArcGIS: Weak Password Recovery Mechanism for Forgotten Password
Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be a
- 9.8 Critical severity
Portal for ArcGIS: Incorrect Privilege Assignment
An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.
- 7.2 High severity
Portal for ArcGIS: Incorrect Privilege Assignment
An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developer credentials that may grant more privileges than expected.
- 9.8 Critical severity
Portal for ArcGIS: Use of Hard-coded Credentials
A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative access to the system.
- 7.5 High severity
Portal for ArcGIS: External Control of File Name or Path
There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files.
- 8.5 High severity
Portal for ArcGIS: Improper Authentication
There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux, and ArcGIS Enterprise versions 11.1 and below on Kubernetes, which under unique circumstances could a
- 7.2 High severity
Portal for ArcGIS: Improper Neutralization of Input During Web Page Generation
There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error messages. The are no privileges required to e
- 9.9 Critical severity
Portal for ArcGIS: Improper Limitation of a Pathname to a Restricted Directory
There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Successful exploitation may allow a remote, authenticated attacker to traverse the file system to access files or execute code outside of the intended directory.
- 8.4 High severity
Portal for ArcGIS Sites: Improper Neutralization of Input During Web Page Generation
There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could result in the execution of arbitrary Jav
- 8.4 High severity
Portal for ArcGIS Sites: Improper Neutralization of Input During Web Page Generation
There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that may allow a remote, authenticated attacker with high‑privileged access to create a crafted link that is persisted within the site configurat
- 8.8 High severity
Portal for ArcGIS: Cross-Site Request Forgery
There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an attacker to trick an authorized user into executing unwanted actions.
- 7.5 High severity
ArcGIS Enterprise: Server-Side Request Forgery
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, po
- 7.5 High severity
ArcGIS Enterprise: Server-Side Request Forgery
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, po
- 7.5 High severity
ArcGIS Enterprise: Improper Limitation of a Pathname to a Restricted Directory
In some non-default installations of Esri Portal for ArcGIS versions 10.9.1 and below, a directory traversal issue may allow a remote, unauthenticated attacker to traverse the file system and lead to the disclosure of sensitive data (not customer-published con
- 7.5 High severity
Portal for ArcGIS: Server-Side Request Forgery
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, po
- 7.5 High severity
Portal for ArcGIS: Improper Access Control
There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs.
- 9.6 Critical severity
Portal for ArcGIS: Improper Control of Generation of Code
There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings which could potentially cause arbitrary code execution.
- 7.5 High severity
Portal for ArcGIS: Server-Side Request Forgery
Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs.