CVE-2022-38190CWE-79

Stored cross-site scripting vulnerability in Esri Portal for ArcGIS Configurable Apps

Medium · published August 15, 2022

CVSS v3.1
6.1
EPSS
1%
Percentile
49.7
In the wild
Unconfirmed
What it is

A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS configurable apps may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00634 · 49.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-08-15T20:45Z
EPSS history
Timeline
  • 15 AUG 20:45Z
    Stored cross-site scripting vulnerability in Esri Portal for ArcGIS Configurable Apps
    cvelistv5