There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.1 · esriNVD modified 2026-10-09 09:10
Affected (CPE criteria) 20
cpe:2.3:a:esri:portal_for_arcgis:10.9.1:-:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update1:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update2:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.0:*:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.2:-:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update1:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update2:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update1:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update2:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update1:*:*:*:*:*:*cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update2:*:*:*:*:*:*