CVE-2022-38200 — BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server.

CVE-2022-38200

BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server. PUBLISHED

Description (CNA)

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser.

Affected (CNA)

Vendor / product	Versions
Esri / ArcGIS Server	affected All through 10.8.1

CWE

CWE-79

References

https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-map-service-security-2022-update-1-is-now-available

ADP enrichment

CVE

No English description supplied.

https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-map-service-security-2022-update-1-is-now-available

CISA-ADP

No English description supplied.

No references supplied.