CVE-2022-38197: 
ArcGIS Server vulnerability analysis and mitigation

Esri ArcGIS Server versions 10.9.1 and below contain an unvalidated redirect vulnerability identified as CVE-2022-38197. The vulnerability was disclosed on October 25, 2022, affecting the ArcGIS Server software platform (Vendor Advisory).

The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site) with a CVSS v3.1 base score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The vulnerability allows for unvalidated redirects through crafted query parameters (NVD).

If exploited, this vulnerability could allow a remote, unauthenticated attacker to perform phishing attacks by redirecting users to attacker-controlled websites through crafted query parameters (Vendor Advisory).

The vulnerability requires user interaction and can be exploited remotely without authentication. The attack complexity is considered Low, indicating relatively straightforward exploitation methods (NVD).

Esri has released an official security patch (ArcGIS Server Security 2022 Update 1 Patch) to address this vulnerability. As a workaround, administrators can disable administration via the ArcGIS Web Adaptor, which is recommended as a best practice when exposing ArcGIS Server to the public internet (Vendor Advisory).