CVE-2022-38201: Esri Arcgis Quickcapture

Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days.

An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker can potentially induce an unsuspecting authenticated user to access an an attacker controlled domain.

Affected products

• Esri Arcgis Quickcapture: from 10.8.1, up to and including 10.9.1

Published 2022-11-15. Last modified 2026-06-17.