Esri Arcgis Server vulnerabilities, page 3
76 vulnerabilities
Known vulnerabilities in Esri Arcgis Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2022-38200esri · arcgis serverBUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server.A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser.EPSS0.40%HighCVE-2022-38202esri · arcgis serverBUG-000152121 - Directory traversal vulnerability in ArcGIS Server.There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker traverse the file system to access files outside of the intended directory on ArcGIS Server. This could lead to the disclosure of sensitive site configuration information (not user datasets).EPSS1.38%HighCVE-2022-38196esri · arcgis serverBUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerabilityEsri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory.EPSS1.19%MediumCVE-2022-38197esri · arcgis serverBUG-000148347 Unvalidated redirect issues in ArcGIS Server.Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter.EPSS0.63%MediumCVE-2022-38199esri · arcgis serverBUG-000144172 - Remote file download issue in ArcGIS ServerA remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. Current browsers provide users with warnings against running unsigned executables downloaded from the internet.EPSS0.32%MediumCVE-2012-4949esri · arcgis serveresri arcgis serverSQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service.EPSS4.39%HighCVE-2024-51961esri · arcgis serverLocal file inclusion (LFI) vulnerability in ArcGIS ServerThere is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server. Due to the nature of the files accessible in this vulnerability the impact to confidentiality is High there is no impact to both integrity or availability.EPSS0.47%HighCVE-2024-51962esri · arcgis serverSQL injection vulnerability in ArcGIS ServerA SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed by a remote authenticated user requiring elevated, non‑administrative privileges. Exploitation is restricted to users with advanced application‑specific permissions, indicating high privileges are required. Successful exploitation would have a high impact on integrity and confidentiality, with no impact on availability.EPSS0.51%MediumCVE-2024-51958esri · arcgis serverDirectory traversal vulnerability in the admin api for service thumbnailsThere is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory. There is no impact to integrity or availability due to the nature of the files that can be accessed, but there is a potential high impact to confidentiality.EPSS0.61%MediumCVE-2024-51944esri · arcgis serverStored XSS in Rest Services DirectoryThere is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.EPSS0.27%MediumCVE-2024-51949esri · arcgis serverStored XSS vulnerability in Rest Services under OGCFeature Service and Map ServiceThere is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.EPSS0.27%MediumCVE-2024-51960esri · arcgis serverStored XSS in ArcGIS Server Administrator DirectoryThere is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.EPSS0.27%MediumCVE-2024-51966esri · arcgis serverDirectory traversal vulnerability in ArcGIS ServerThere is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory. There is no impact to integrity or availability due to the nature of the files that can be accessed, but there is a potential high impact to confidentiality.EPSS0.60%MediumCVE-2024-51942esri · arcgis serverStored XSS vulnerability in Rest Admin API under Hosted Feature Services pageThere is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.EPSS0.27%MediumCVE-2024-51963esri · arcgis serverStored XSS in ArcGIS Server ManagerThere is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and follow that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.EPSS0.27%MediumCVE-2024-51948esri · arcgis serverStored XSS vulnerability in Rest Services under Job IDThere is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.EPSS0.27%MediumCVE-2024-51951esri · arcgis serverStored XSS in Server Admin APIThere is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.EPSS0.27%HighCVE-2024-51954esri · arcgis serverUnauthorized access to secure services in ArcGIS ServerThere is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker to access secure services published to a standalone (unfederated) ArcGIS Server instance. Successful exploitation results in unauthorized access to protected services outside the attacker’s originally assigned authorization boundary, constituting a scope change. If exploited, this issue would have a high impact on confidentiality, a low impact on integrity, and no impact on the availability of the software.EPSS0.32%MediumCVE-2024-51947esri · arcgis serverStored XSS vulnerability in Rest Services under Layer nameThere is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.EPSS0.27%MediumCVE-2024-51959esri · arcgis serverStored XSS issue in Server Admin APIThere is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.EPSS0.27%