CVE-2024-38037

Summary

CVE-2024-38037 is a newly disclosed vulnerability affecting Esri Portal for ArcGIS versions 11.0 and 10.9.1. This issue involves an unvalidated redirect, enabling a remote, unauthenticated attacker to craft malicious URLs. If successful, the victim would be redirected to an arbitrary website, potentially falling prey to phishing attacks. This vulnerability poses a significant risk, particularly in enterprise environments where users may trust links within the portal. Organizations utilizing these versions of Esri Portal for ArcGIS are strongly encouraged to apply the forthcoming patches to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.