CVE-2022-38210 MEDIUM

CVE-2022-38210: HTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only)

Vendor Esri
Product ArcGIS Enterprise
Weakness CWE-80 · XSS · basic
Published December 30, 2022
Last update April 10, 2025
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

There is a reflected HTML injection vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser.

Key dates

02Disclosure timeline

December 30, 2022 CVE published
April 10, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-15058 Responsive Pricing Table <= 5.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'table_currency' CVE-2024-12127 Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS <= 0.0.21 - Reflected Cross-Site Scripting via page Parameter CVE-2026-11511 Bolt CMS HTML Attribute TextType.php HTML injection CVE-2025-32230 WordPress Tutor LMS plugin <= 3.4.0 - HTML Injection vulnerability CVE-2025-24680 WordPress WP Multi Store Locator Plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability