CVE-2025-2538 | THREATINT

Description

A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote authenticated attacker to gain administrative access to the system.

Reserved 2025-03-19 | Published 2025-03-20 | Updated 2025-04-01 | Assigner Esri

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-798 Use of Hard-coded Credentials

Product status

Default status

unaffected

10.9.1

affected

11.1

affected

11.2

affected

11.3

affected

11.4

affected

References

www.esri.com/...tal-for-arcgis-security-2025-update-1-patch/

cve.org (CVE-2025-2538)

nvd.nist.gov (CVE-2025-2538)

Download JSON