CVE-2024-38037

Description

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.0 and 10.9.1 that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

Reserved 2024-06-11 | Published 2024-10-04 | Updated 2024-10-08 | Assigner Esri

Problem types

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Product status

Default status
unaffected

10.9.1
affected

11.1
affected

References

www.esri.com/...-for-arcgis-security-2024-update-2-released/

cve.org (CVE-2024-38037)

nvd.nist.gov (CVE-2024-38037)

Download JSON