CVE-2022-38202 — BUG-000152121 - Directory traversal vulnerability in ArcGIS Server.

Description (CNA)

There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker traverse the file system to access files outside of the intended directory on ArcGIS Server. This could lead to the disclosure of sensitive site configuration information (not user datasets).

Affected (CNA)

Vendor / product	Versions
Esri / ArcGIS Server	affected 11.0 through all

CWE

CWE-23

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2022-update-2-patch-is-now-available

ADP enrichment

CVE

No English description supplied.

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2022-update-2-patch-is-now-available

CISA-ADP

No English description supplied.

No references supplied.