PT-2022-24279 · Esri · Arcgis Server

Published 2022-12-28 · Updated 2024-08-31 · CVE-2022-38202

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Esri ArcGIS Server versions 10.9.1 and below

Description The issue allows a remote, unauthenticated attacker to traverse the file system and access files outside of the intended directory on ArcGIS Server. This could lead to the disclosure of sensitive site configuration information, but not user datasets.

Recommendations For Esri ArcGIS Server versions 10.9.1 and below, update to a version above 10.9.1 to resolve the issue. At the moment, there is no information about other specific fixes for this vulnerability.

Fix

Path traversal

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-23

Related Identifiers

CVE-2022-38202

Affected Products

Arcgis Server

References · 5

• https://osv.dev/vulnerability/CVE-2022-38202 · Vendor Advisory
• https://esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2022-update-2-patch-is-now-available · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38202 · Security Note
• https://twitter.com/0x3x54/status/1830093077463126527 · Twitter Post
• https://t.me/cibsecurity/55503 · Telegram Post