The version of Esri Portal for ArcGIS installed is missing Security 2024 Update 1. It is, therefore, affected by multiple vulnerabilities including:

  - There is a difficult to exploit improper authentication issue in the Home application for Esri Portal for     ArcGIS versions 10.8.1 through 11.2 on Windows and Linux, and ArcGIS Enterprise 11.1 and below on     Kubernetes which, under unique circumstances, could potentially allow a remote, unauthenticated attacker     to compromise the confidentiality, integrity, and availability of the software. (CVE-2024-25699)

  - There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.1 and below that     may in some cases allow a remote, unauthenticated attacker to trick an authorized user into executing     unwanted actions via a crafted form. The impact to Confidentiality and Integrity vectors is limited and of     low severity. (CVE-2024-25692)

  - There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions <= 11.2 that may allow a     remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error     messages. The are no privileges required to execute this attack. (CVE-2024-25695)

  - There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Successful exploitation may allow a     remote, authenticated attacker to traverse the file system to access files or execute code outside of the     intended directory. (CVE-2024-25693)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Esri Portal for ArcGIS < Security 2024 Update 1 Multiple Vulnerabilities (10.8.1)

critical Nessus Plugin ID 193182

Version 1.2

Version 1.1

Version 1.0

Version 1.2 Jan 9, 2025, 7:19 AM CVSS metrics ("CVSSv2 score" set to 9.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2024-25693, severity increased from "Medium" to "High") Plugin Feed: 202501090719
Version 1.1 Apr 12, 2024, 12:13 PM IAVM reference STIG Severity (set to "I") Plugin Feed: 202404121213
Version 1.0 Apr 11, 2024, 4:12 PM New Plugin Feed: 202404111612