CVE-2024-51966

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-51966
There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory. There is no impact to integrity or availability due to the nature of the files that can be accessed, but there is a potential high impact to confidentiality.

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/ Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:esri:arcgis_server:*:*:*:*:*:*:*:*
History

10 Apr 2025, 20:15

Type Values Removed Values Added
Summary (en) There is a path traversal vulnerability in ESRI ArcGIS Server versions 10.9.1 thru 11.3. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory. There is no impact to integrity or availability due to the nature of the files that can be accessed, but there is a potential high impact to confidentiality. (en) There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory. There is no impact to integrity or availability due to the nature of the files that can be accessed, but there is a potential high impact to confidentiality.

06 Mar 2025, 14:23

Type Values Removed Values Added
References () https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/ - () https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/ - Vendor Advisory
Summary
  • (es) Existe una vulnerabilidad de path traversal en las versiones 10.9.1 a 11.3 de ESRI ArcGIS Server. Si se explota con éxito, es posible que un atacante remoto autenticado con privilegios de administrador pueda recorrer el sistema de archivos para acceder a archivos fuera del directorio previsto. No hay impacto en la integridad ni en la disponibilidad debido a la naturaleza de los archivos a los que se puede acceder, pero existe un alto potencial de impacto en la confidencialidad.
CPE cpe:2.3:a:esri:arcgis_server:*:*:*:*:*:*:*:*
First Time Esri arcgis Server
Esri

03 Mar 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-03 20:15

Updated : 2025-04-10 20:15

NVD link : CVE-2024-51966

Mitre link : CVE-2024-51966

CVE.ORG link : CVE-2024-51966

JSON object : View

Products Affected

esri

  • arcgis_server
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')