GCVE - cpe:2.3:a:esri:portal_for_arcgis:10.8.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:esri:portal_for_arcgis:10.8.1:*:*:*:*:*:*:*

part: a version: 10.8.1 update: *

Vendor	Esri (`7fc7b1c4-e95b-5bc9-bfb4-4695cd2e3e82`)
Product	Portal For Arcgis (`4a9585b9-e85b-56ed-a5e6-c7c2789574cc`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-8148`	vulnerable	2026-06-08 07:00:22.746128	BUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (11.2, 11.1, 10.9.1. and 10.8.1) MEDIUM (6.1) There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks. Published: 2024-10-04T17:11:43.279Z Updated: 2025-04-10T19:11:58.566Z Open on db.gcve.eu Reference links https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-38040`	vulnerable	2026-06-08 06:39:49.044339	BUG-000167984 - Portal for ArcGIS has a Local file inclusion (LFI) vulnerability HIGH (7.5) There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files. Published: 2024-10-04T18:04:01.657Z Updated: 2025-04-10T18:52:18.843Z Open on db.gcve.eu Reference links https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-38038`	vulnerable	2026-06-08 06:39:49.043221	BUG-000165732 - Reflected XSS in Portal for ArcGIS MEDIUM (6.1) There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 11.1 which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Published: 2024-10-04T17:19:24.306Z Updated: 2025-04-10T19:19:18.927Z Open on db.gcve.eu Reference links https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-38036`	vulnerable	2026-06-08 06:39:49.039074	BUG-000154827 - Reflected XSS in ArcGIS Experience Builder MEDIUM (5.4) There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Published: 2024-10-04T17:16:24.601Z Updated: 2025-04-10T19:13:35.971Z Open on db.gcve.eu Reference links https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-25709`	vulnerable	2026-06-08 06:31:23.766793	Self-XSS style in move item dialog MEDIUM (6.1) There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.2 and below that may allow a remote, authenticated attacker to create a crafted link that can be saved as a new location when moving an existing item, which could potentially execute arbitrary JavaScript code in a victim’s browser. Exploitation does not require any privileges and can be performed by an anonymous user. Published: 2024-04-04T17:55:17.893Z Updated: 2026-02-06T06:10:48.587Z Open on db.gcve.eu Reference links https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2024-update-1/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-25698`	vulnerable	2026-06-08 06:31:23.740095	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-25691`	vulnerable	2026-06-08 06:31:23.727941	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-25831`	vulnerable	2026-06-08 05:56:10.691406	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-25830`	vulnerable	2026-06-08 05:56:10.690848	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-38207`	vulnerable	2026-06-08 05:47:16.039375	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-38204`	vulnerable	2026-06-08 05:47:16.037512	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-38194`	vulnerable	2026-06-08 05:47:16.022601	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.