CVE-2023-25834CWE-269

BUG-000142922 Incomplete permission changes in specific cases.

Medium · published May 9, 2023

CVSS v3.1
5.4
EPSS
0%
Percentile
24.1
In the wild
Unconfirmed
What it is

Changes to user permissions in Portal for ArcGIS 10.9.1 and below are incompletely applied in specific use cases. This issue may allow users to access content that they are no longer privileged to access.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00323 · 24.1th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2023-05-09T00:00Z
EPSS history
Timeline
  • 09 MAY 00:00Z
    BUG-000142922 Incomplete permission changes in specific cases.
    cvelistv5