CVE-2024-51961: falha de alta gravidade em Esri ArcGIS Server
Local file inclusion (LFI) vulnerability in ArcGIS Server
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.5%
There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server. Due to the nature of the files accessible in this vulnerability the impact to confidentiality is High there is no impact to both integrity or availability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Esri · ArcGIS ServerCVEs relacionadas — Esri ArcGIS Server
No mesmo produto, das mais perigosas para as menos.
CVE-2021-29115MEDIUMAn information disclosure vulnerabilityEPSS 2.2%CVE-2021-29102CRITICALThere is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.EPSS 1.6%CVE-2022-38202HIGHBUG-000152121 - Directory traversal vulnerability in ArcGIS Server.EPSS 1.4%CVE-2026-9181CRITICALDirectory Traversal in ArcGIS ServerEPSS 1.2%CVE-2022-38196MEDIUMBUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerabilityEPSS 1.2%CVE-2021-29114HIGHSQL injection vulnerability in ArcGIS ServerEPSS 1.0%