CVE-2022-38194
CVE-2022-38194 is a medium-severity vulnerability in Esri Portal For Arcgis with a CVSS 3.x base score of 6.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-311.
Key facts
- Severity: Medium (CVSS 3.x base score 6.7)
- EPSS exploit prediction: 0% (3rd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-311
- Affected product: Esri Portal For Arcgis
- Published:
- Last modified:
Description
In Esri Portal for ArcGIS versions 10.8.1, a system property is not properly encrypted. This may lead to a local user reading sensitive information from a properties file.
Frequently asked questions
- What is CVE-2022-38194?
- In Esri Portal for ArcGIS versions 10.8.1, a system property is not properly encrypted. This may lead to a local user reading sensitive information from a properties file.
- How severe is CVE-2022-38194?
- CVE-2022-38194 has a CVSS 3.x base score of 6.7, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity low, and availability none.
- Is CVE-2022-38194 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (3rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2022-38194?
- CVE-2022-38194 affects Esri Portal For Arcgis. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2022-38194?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2022-38194 published?
- CVE-2022-38194 was published on 2022-08-16 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:esri:portal_for_arcgis:10.8.1:*:*:*:*:*:*:*
More vulnerabilities in Esri Portal For Arcgis
- CVE-2024-25693 — Critical (CVSS 9.9): There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Successful exploitation may allow a remote,…
- CVE-2026-33519 — Critical (CVSS 9.8): An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and…
- CVE-2026-33518 — Critical (CVSS 9.8): An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows…
- CVE-2025-2538 — Critical (CVSS 9.8): A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4…
- CVE-2025-4967 — Critical (CVSS 9.1): Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF…
- CVE-2023-25832 — High (CVSS 8.8): There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an…
All CVEs affecting Esri Portal For Arcgis →
Other CWE-311 (Missing Encryption of Sensitive Data) vulnerabilities
- CVE-2023-6339 — Critical (CVSS 10.0): Google Nest WiFi Pro root code-execution & user-data compromise
- CVE-2023-4420 — Critical (CVSS 9.8): A remote unprivileged attacker can intercept the communication via e.g. Man-In-The-Middle, due to the absence of…
- CVE-2023-0750 — Critical (CVSS 9.8): Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface. When the device can be…
- CVE-2020-15331 — Critical (CVSS 9.8): Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded OAUTH_SECRET_KEY in /opt/axess/etc/default/axess.
- CVE-2019-3431 — Critical (CVSS 9.8): All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems vulnerability. Attackers…
- CVE-2019-12924 — Critical (CVSS 9.8): MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be…
Browse all CWE-311 (Missing Encryption of Sensitive Data) vulnerabilities →