A flaw in Portal for ArcGIS enables LDAP injection through administrative functions that build LDAP search queries without proper input neutralization. An authenticated administrator can supply crafted input that alters the intended LDAP query, potentially causing unintended directory operations.

Esri Portal for ArcGIS

The vulnerability carries a CVSS score of 5.5 and is not listed in the CISA KEV catalog. The EPSS score is not available. Exploitation requires that the attacker authenticate as an administrator, so the likelihood depends on the exposure of administrative credentials and the security posture of the administrative accounts. If leveraged, the attacker could read, modify, or delete directory entries based on the altered query, impacting confidentiality and integrity of the directory data.