Esri has released the Portal for ArcGIS Security 2024 Update 2 Patch that resolves multiple high and medium severity security vulnerabilities across versions 11.2, 11.1, 10.9.1, 10.8.1.
This patch was released on August 22nd, 2024, and is available here.
January 14, 2025: The 10.9.1 and 10.8.1 versions of the Portal for ArcGIS Security 2024 Update 2 Patch have been updated to resolve BUG-000154028. Refer to the Issues Addressed with this Patch section for details about BUG-000154028. Additionally, the Linux setups have been updated to address an uninstall issue. Please download and install the new setup. It is not necessary to uninstall the original patch, the new setup will install and replace the original patch. The new patch when shown as available in the ArcGIS Enterprise Patch Notification tool, is listed as Portal for ArcGIS Security 2024 Update 2 Patch (without the B suffix) with a release date of January 14, 2025; once installed, it is listed as Portal for ArcGIS Security 2024 Update 2 Patch B.
We provide Common Vulnerability Scoring System v.3.1 and v.4.0 (CVSS) scores to allow our customers to better assess the risk of these vulnerabilities to their operations. Both base and modified temporal scores are provided to reflect the availability of an official patch.
Vulnerabilities fixed by this patch.
Local File Inclusion – (LFI)
- CVE Details: CVE-2024-38040
- CWE-73: External Control of File Name or Path
- Base CVSS 3.1: 7.5 Base CVSS 4.0: 8.7
Cross Site Scripting – (XSS)
- CVE Details: CVE-2024-38038
- CWE-79: Improper Neutralization of Input During Web Page Generation
- Base CVSS 3.1: 6.1 Base CVSS 4.0: 5.3
Cross Site Scripting – (XSS)
- CVE Details: CVE-2024-25691
- CWE-79 Improper Neutralization of Input During Web Page Generation
- Base CVSS 3.1: 6.1 Base CVSS 4.0: 5.3
Unvalidated Redirect
- CVE Details: CVE-2024-38037
- CWE-601 URL Redirection to Untrusted Site (‘Open Redirect’)
- Base CVSS 3.1: 6.1 Base CVSS 4.0: 5.3
- Mitigation’s:
-
- Portal for ArcGIS Security 2024 Update 2 Patch.
- Secure ArcGIS Enterprise’s Help Documentation.
-
Unvalidated Redirect
- CVE Details: CVE-2024-8148
- CWE-601 URL Redirection to Untrusted Site (‘Open Redirect’)
- Base CVSS 3.1: 6.1 Base CVSS 4.0: 5.3
HTML Injection
- CVE Details: CVE-2024-38039
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’)
- Base CVSS 3.1: 5.4 Base CVSS 4.0: 5.1
Cross Site Scripting – (XSS)
- CVE Details: CVE-2024-25694
- CWE-79 Improper Neutralization of Input During Web Page Generation
- Base CVSS 3.1: 4.8 Base CVSS 4.0: 4.8
Cross Site Scripting – (XSS)
- CVE Details: CVE-2024-25701
- CWE-79 Improper Neutralization of Input During Web Page Generation
- Base CVSS 3.1: 4.8 Base CVSS 4.0: 4.8
Cross Site Scripting – (XSS)
- CVE Details: CVE-2024-25702
- CWE-79 Improper Neutralization of Input During Web Page Generation
- Base CVSS 3.1: 4.8 Base CVSS 4.0: 4.8
Cross Site Scripting – (XSS)
- CVE Details: CVE-2024-25707
- CWE-79 Improper Neutralization of Input During Web Page Generation
- Base CVSS 3.1: 4.8 Base CVSS 4.0: 4.8
Cross Site Scripting – (XSS)
- CVE Details: CVE-2024-38036
- CWE-79 Improper Neutralization of Input During Web Page Generation
- Base CVSS 3.1: 4.6 Base CVSS 4.0: 5.1
Cross Site Scripting – (XSS)
Commenting is not enabled for this article.