CVE-2022-38202

HIGH Year: 2022
CVSS v3 Score
7.5
High
Weakness Type
CWE-23
View all →

Vulnerability Description

There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker traverse the file system to access files outside of the intended directory on ArcGIS Server. This could lead to the disclosure of sensitive site configuration information (not user datasets).

Related Vulnerabilities

CVE-2018-12473

HIGH
CVSS:7.5(High)

A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause access files not in the current build. On the server itself this is prevented by ...

CWE-232018

CVE-2018-12476

HIGH
CVSS:7.5(High)

Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a repository to overwrite files on the machi...

CWE-232018

CVE-2019-13408

HIGH
CVSS:7.5(High)

A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without an...

CWE-232019

CVE-2020-17518

HIGH
CVSS:7.5(High)

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be w...

CWE-232020

CVE-2020-5280

HIGH
CVSS:7.5(High)

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server....

CWE-232020

CVE-2020-5410

HIGH
CVSS:7.5(High)

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-con...

CWE-232020