Description
Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Esri | Portal for ArcGIS | All – ≤ 10.8.1 | — |