CVE-2024-25699 Vulnerability Details

  /     /     /  

CVE-2024-25699 Metadata Quick Info

CVE Published: 04/04/2024 | CVE Updated: 08/10/2024 | CVE Year: 2024
Source: Esri | Vendor: Esri | Product: Portal for ArcGIS
Status : PUBLISHED

---

CVE-2024-25699 Description

There is a difficult to exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 10.8.1 through 11.2 on Windows and Linux, and ArcGIS Enterprise 11.1 and below on Kubernetes which, under unique circumstances, could potentially allow a remote, unauthenticated attacker to compromise the confidentiality, integrity, and availability of the software.

Metrics

CVSS Version: 3.1 | Base Score: 8.5 HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* HIGH
    Privileges Required (PR)* LOW
    User Interaction (UI)* NONE
    Scope (S)* CHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-287
CWE Name: CWE-287 Improper Authentication
Source: Esri

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-475
CAPEC Description: CAPEC-475 Signature Spoofing by Improper Validation


Source: NVD (National Vulnerability Database).