CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38196 – BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability
https://notcve.org/view.php?id=CVE-2022-38196
Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory. Esri ArcGIS Server versiones 10.9.1 y anteriores, presentan una vulnerabilidad de salto de ruta que puede resultar en una denegación de servicio al permitir que un atacante remoto y autenticado sobrescriba el directorio interno de ArcGIS Server • https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38197 – BUG-000148347 Unvalidated redirect issues in ArcGIS Server.
https://notcve.org/view.php?id=CVE-2022-38197
Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter. Esri ArcGIS Server versiones 10.9.1 y posteriores de Esri ArcGIS Server presentan un problema de redireccionamiento no comprobado que puede permitir a un atacante remoto no autenticado engañar a un usuario para que acceda a un sitio web controlado por un atacante por medio de un parámetro de consulta diseñado • https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38198 – BUG-000146513 - Reflected XSS vulnerability in ArcGIS Server
https://notcve.org/view.php?id=CVE-2022-38198
There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated attacker to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser. Se presenta un problema de tipo cross site scripting reflejado en el directorio de servicios de Esri ArcGIS Server versiones 10.9.1 y anteriores, que puede permitir a un atacante remoto no autenticado convencer a un usuario de que haga clic en un enlace diseñado que podría ejecutar código JavaScript arbitrario en el navegador de la víctima • https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2022-38199 – BUG-000144172 - Remote file download issue in ArcGIS Server
https://notcve.org/view.php?id=CVE-2022-38199
A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. Current browsers provide users with warnings against running unsigned executables downloaded from the internet. Puede producirse un problema de descarga remota de archivos en algunas capacidades de los servicios web de Esri ArcGIS Server que, en algunos casos extremos, puede permitir a un atacante remoto no autenticado inducir a una víctima desprevenida a iniciar un proceso en el entorno PATH de la víctima. Los navegadores actuales proporcionan a usuarios advertencias contra la ejecución de ejecutables no firmados descargados de Internet • https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch • CWE-494: Download of Code Without Integrity Check •