CVE-2024-8148 BUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (11.2, 11.1, 10.9.1. and 10.8.1)
Remote attackers can craft URLs to redirect victims to arbitrary sites, facilitating phishing attacks against Esri Portal for ArcGIS users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-8148?
CVE-2024-8148 is a medium-severity vulnerability in Esri Portal for Arcgis, published on 4 Oct 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.
Weakness: CWE-601
Which versions are affected by CVE-2024-8148?
It affects 1 product.
Products include Esri Portal for Arcgis.
How do I fix CVE-2024-8148?
No fix has been published for CVE-2024-8148 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-8148 being exploited?
There is no known exploitation of CVE-2024-8148 in the wild and no public exploit code.
Other vulnerabilities in Esri Portal for Arcgis
Sources
Also known as GHSA-qfpj-fgmr-ww6v.