CVE-2022-38189 MEDIUM

CVE-2022-38189: There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.

Vendor Esri

Product Portal for ArcGIS

Weakness CWE-79 · XSS

Published August 16, 2022

Last update April 10, 2025

View on NVD All CVEs

CVSS base score

5.4/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

Description

A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.

Key dates

Disclosure timeline

August 16, 2022 CVE published

April 10, 2025 Record updated