CVE-2025-2538

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2538
A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative access to the system.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-1-patch/ Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*
History

30 Jul 2025, 20:01

Type Values Removed Values Added
First Time Esri
Esri portal For Arcgis
References () https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-1-patch/ - () https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-1-patch/ - Vendor Advisory
CPE cpe:2.3:a:esri:portal_for_arcgis:*:*:*:*:*:*:*:*

09 Jul 2025, 15:15

Type Values Removed Values Added
Summary (en) A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote authenticated attacker to gain administrative access to the system. (en) A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative access to the system.

01 Apr 2025, 14:15

Type Values Removed Values Added
Summary (en) A specific type of Portal for ArcGIS deployment is vulnerable to a Password Recovery Exploitation. (en) A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote authenticated attacker to gain administrative access to the system.

01 Apr 2025, 02:15

Type Values Removed Values Added
Summary (en) Some deployments of Esri ArcGIS Enterprise are vulnerable to an improper authentication vulnerability. (en) A specific type of Portal for ArcGIS deployment is vulnerable to a Password Recovery Exploitation.

25 Mar 2025, 14:15

Type Values Removed Values Added
Summary (en) A specific type of ArcGIS Enterprise deployment is vulnerable to a Password Recovery Exploitation vulnerability in Portal for ArcGIS". (en) Some deployments of Esri ArcGIS Enterprise are vulnerable to an improper authentication vulnerability.

24 Mar 2025, 20:15

Type Values Removed Values Added
Summary (en) A specific type of ArcGIS Enterprise deployment is vulnerable to a Password Recovery Exploitation vulnerability in Portal that could allow an attacker to reset the password on the built in-admin account. (en) A specific type of ArcGIS Enterprise deployment is vulnerable to a Password Recovery Exploitation vulnerability in Portal for ArcGIS".

21 Mar 2025, 20:15

Type Values Removed Values Added
Summary
  • (es) Un tipo específico de implementación de ArcGIS Enterprise es afectado por una vulnerabilidad de explotación de recuperación de contraseña en Portal, que podría permitir a un atacante restablecer la contraseña en la cuenta de administrador integrada.
Summary (en) A specific type of ArcGIS Enterprise deployment, is vulnerable to a Password Recovery Exploitation vulnerability in Portal, that could allow an attacker to reset the password on the built in admin account. (en) A specific type of ArcGIS Enterprise deployment is vulnerable to a Password Recovery Exploitation vulnerability in Portal that could allow an attacker to reset the password on the built in-admin account.

20 Mar 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-20 21:15

Updated : 2025-07-30 20:01

NVD link : CVE-2025-2538

Mitre link : CVE-2025-2538

CVE.ORG link : CVE-2025-2538

JSON object : View

Products Affected

esri

  • portal_for_arcgis
CWE
CWE-798

Use of Hard-coded Credentials