PT-2025-9558 · Esri · Esri Arcgis Server

Publicado 2025-02-18 · Atualizado 2025-03-04 · CVE-2024-51958

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions ESRI ArcGIS Server versions 10.9.1 through 11.3

Description The issue allows a remote authenticated attacker with admin privileges to traverse the file system and access files outside of the intended directory, potentially leading to a high impact on confidentiality. There is no impact to integrity or availability due to the nature of the files that can be accessed.

Recommendations For ESRI ArcGIS Server versions 10.9.1 through 11.3, update to a version that contains a fix for this issue to prevent path traversal exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2025-02371

CVE-2024-51958

Produtos afetados

Esri Arcgis Server

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-51958 · Nota de Segurança
• https://esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1896767564484624835 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2025-02371 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2024-51958 · Aviso do Fabricante
• https://t.me/cvedetector/19418 · Publicação no Telegram