high7.5
CVE-2022-38187
Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attac…
Impact
Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Esri | Portal For Arcgis | before 10.9 |