CVE-2022-38200 MEDIUM

CVE-2022-38200: BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server.

Vendor Esri

Product ArcGIS Server

Weakness CWE-79 · XSS

Published October 25, 2022

Last update April 10, 2025

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser.

Key dates

02Disclosure timeline

October 25, 2022 CVE published

April 10, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-38200 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-12976 Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode CVE-2026-1001 Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint CVE-2024-12507 Optio Dentistry <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-20251 CVE-2026-1823 Consensus Embed <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute