Описание
Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs.
Ссылки
- Not ApplicableVendor Advisory
- Not ApplicableVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 10.9 (исключая)
cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*
EPSS
Процентиль: 58%
0.00362
Низкий
7.5 High
CVSS3
Дефекты
CWE-918
NVD-CWE-noinfo
Связанные уязвимости
CVSS3: 7.5
github
больше 3 лет назад
Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs.
EPSS
Процентиль: 58%
0.00362
Низкий
7.5 High
CVSS3
Дефекты
CWE-918
NVD-CWE-noinfo