CVE-2022-38200: Esri Arcgis Server

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser.

Affected products

• Esri Arcgis Server: version 10.7.1 only; version 10.8.1 only

Published 2022-10-25. Last modified 2026-06-17.