← Database

CVE-2022-38197

MEDIUM CVSS: 6.1 Published: 2022-10-25 Modified: 2026-06-17

Description

Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter.

Affected Platforms

Esri Arcgis Server

Weakness Type

CWE-601, CWE-601

References