An information disclosure flaw in Esri Portal for ArcGIS allows a remote, unauthenticated attacker to reflect sensitive data in an HTTP response body. The weakness, classified as CWE‑200, undermines confidentiality by potentially exposing proprietary or personal information. In cases where the attack conditions are met, the data reflected could reveal details that the portal intended to hide from unauthenticated users.

Affected systems are Esri Portal for ArcGIS versions 12.0 and earlier. The flaw exists in the portal’s handling of HTTP requests, and no specific minor releases beyond 12.0 are known to be impacted. Administrators should verify which exact version they run and note that the issue does not affect newer releases after 12.0.

The CVSS score of 5.9 indicates a moderate severity, and the EPSS score is not available, implying a lack of public exploitation data. Because the vulnerability requires difficult‑to‑reproduce conditions and is remote, the attack surface is limited to unauthenticated HTTP requests. The CVE is not listed in CISA’s KEV catalog. Nonetheless, attackers who succeed could glean sensitive data, so the risk warrants timely remediation.