CVE-2024-51961: fallo de gravedad alta en Esri ArcGIS Server
Local file inclusion (LFI) vulnerability in ArcGIS Server
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.5%
There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server. Due to the nature of the files accessible in this vulnerability the impact to confidentiality is High there is no impact to both integrity or availability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
Esri · ArcGIS ServerCVEs relacionadas — Esri ArcGIS Server
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-29115MEDIUMAn information disclosure vulnerabilityEPSS 2.2%CVE-2021-29102CRITICALThere is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.EPSS 1.6%CVE-2022-38202HIGHBUG-000152121 - Directory traversal vulnerability in ArcGIS Server.EPSS 1.4%CVE-2026-9181CRITICALDirectory Traversal in ArcGIS ServerEPSS 1.2%CVE-2022-38196MEDIUMBUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerabilityEPSS 1.2%CVE-2021-29114HIGHSQL injection vulnerability in ArcGIS ServerEPSS 1.0%