[{"vendor":"esri","product":"portal_for_arcgis","defaultStatus":"unknown","cpes":["cpe:2.3:a:esri:portal_for_arcgis:10.8.1:*:*:*:*:*:*:*","cpe:2.3:a:esri:portal_for_arcgis:10.9.1:*:*:*:*:*:*:*","cpe:2.3:a:esri:portal_for_arcgis:11.1:*:*:*:*:*:*:*","cpe:2.3:a:esri:portal_for_arcgis:11.2:*:*:*:*:*:*:*"],"versions":[{"version":"10.8.1","status":"affected"},{"version":"10.9.1","status":"affected"},{"version":"11.1","status":"affected"},{"version":"11.2","status":"affected"}]}]

{"timestamp":"2024-10-04T18:34:11.663792Z","id":"CVE-2024-38040","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Esri","product":"Portal for ArcGIS","defaultStatus":"unaffected","platforms":["Windows","Linux"],"versions":[{"version":"All","lessThanOrEqual":"11.2","versionType":"Portal for ArcGIS","status":"affected"}]}]

There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2. 11.1, 11.0 and 10.9.1 that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files.

There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files.

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NIST NVD-CWE-Other

OR
     *cpe:2.3:a:esri:portal_for_arcgis:10.9.1:*:*:*:*:*:*:*
     *cpe:2.3:a:esri:portal_for_arcgis:11.0:*:*:*:*:*:*:*
     *cpe:2.3:a:esri:portal_for_arcgis:11.1:*:*:*:*:*:*:*
     *cpe:2.3:a:esri:portal_for_arcgis:11.2:*:*:*:*:*:*:*

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/ No Types Assigned

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/ Vendor Advisory

There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2. 11.1, 11.0 and 10.9.1 that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files.

Environmental Systems Research Institute, Inc. AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Environmental Systems Research Institute, Inc. CWE-73

Environmental Systems Research Institute, Inc. https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/ [No types assigned]