CVE-2022-38205: high-severity vulnerability in Esri ArcGIS Enterprise
Portal for ArcGIS has a directory traversal vulnerability (10.9.1, 10.8.1 and 10.7.1 only)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Portal for ArcGIS has a flaw that lets attackers access files outside the intended directory on the server, potentially exposing sensitive information. This vulnerability only affects certain non-default installations and requires no authentication.
A directory traversal vulnerability (CWE-23) in Esri Portal for ArcGIS versions 10.9.1, 10.8.1, and 10.7.1 allows unauthenticated remote attackers to manipulate file paths and access arbitrary files on the system, leading to disclosure of sensitive data. The vulnerability is specific to certain non-default server configurations.
In the same product, most dangerous first.