Description

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under difficult to reproduce circumstances allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-21T21:17:03.150Z",
  "pubdate": "2026-08-21T21:17:03.150Z",
  "executiveSummary": "An information disclosure vulnerability exists in Esri Portal for ArcGIS versions 12.0 and earlier. This security flaw allows a remote, unauthenticated attacker to cause sensitive information to be reflected within an HTTP response body under specific, difficult-to-reproduce conditions. The primary impact of this vulnerability is the unintended exposure of confidential data, which could potentially aid malicious actors in reconnaissance or further exploitation phases against the target environment. The flaw affects unauthenticated remote adversaries communicating over network protocols supported by the web application. Exploitation requires the alignment of complex and precise operational parameters, making successful exploitation non-trivial and dependent on specific runtime circumstances. Organizations operating the affected software face potential risks regarding data confidentiality breaches. Addressing this issue requires applying vendor-supplied updates or implementing appropriate administrative configurations to restrict unauthorized data reflection vectors.",
  "technicalDetails": "The vulnerability is rooted in improper input handling or state management within Esri Portal for ArcGIS versions 12.0 and earlier, leading to the reflection of internal or sensitive data back to the client inside the HTTP response body. The affected component processes incoming web requests and, under niche execution paths or anomalous timing conditions, echoes inputs or internal state variables without proper sanitization, filtering, or access control validation. Because the vulnerability is exposed remotely over the network, an unauthenticated attacker does not require prior system access or valid user credentials to interact with the vulnerable endpoint. The attack vector involves sending a specially crafted HTTP request designed to trigger the vulnerable code path. Upon reception, the application fails to isolate sensitive internal context, inadvertently incorporating confidential information into the generated HTTP response payload. The privilege requirements for the attacker are minimal, as the interface handling the request is exposed to unauthenticated network traffic. Due to the stringent preconditions required to trigger the exact vulnerable state, exploitation is classified as difficult to reproduce consistently. However, successful exploitation yields information disclosure, allowing the remote adversary to harvest sensitive internal details returned by the server. Post-exploitation impact is strictly tied to the nature of the leaked data, which may expose system configurations, internal application logic, or user-related data that facilitates subsequent targeted attacks against the deployment."
}