Description

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-21T21:17:03.300Z",
  "pubdate": "2026-08-21T21:17:03.300Z",
  "executiveSummary": "An information disclosure vulnerability exists in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier, allowing remote and unauthenticated threat actors to extract sensitive data via HTTP response bodies.\nThe vulnerability exposes internal system details and confidential information without requiring prior authentication or user interaction.\nThe primary impact is the unauthorized exposure of sensitive data, which could potentially aid attackers in conducting further reconnaissance or targeted attacks against the underlying infrastructure.\nExploitation requires network connectivity to the vulnerable Esri Portal for ArcGIS instance, specifically leveraging the HTTP request-response cycle to trigger the reflection of sensitive variables.\nOrganizations utilizing the affected software versions face elevated security risks regarding data confidentiality, necessitating immediate evaluation and application of available security updates or configuration hardening.",
  "technicalDetails": "The vulnerability stems from improper handling of HTTP requests within Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier, leading to an information disclosure flaw where sensitive data is inadvertently reflected in the HTTP response body.\nThe vulnerable component processes incoming parameters or state inputs insecurely, failing to properly sanitize or restrict output data before returning the HTTP response to the client.\nAn unauthenticated, remote attacker can exploit this weakness by crafting specialized HTTP requests directed at the vulnerable endpoint.\nDuring the attack flow, the malicious or malformed input causes the application to echo internal variables, configuration data, or other sensitive information directly into the payload return of the HTTP response.\nBecause the vulnerability requires no authentication or special privileges, any external entity with network exposure to the Esri Portal for ArcGIS instance can initiate the request and immediately harvest the leaked data from the response headers or body.\nThe post-exploitation impact includes the potential aggregation of architectural details, internal IP addresses, user metadata, or system paths, which significantly lowers the barrier for subsequent reconnaissance and advanced exploitation phases targeting the enterprise deployment."
}