1. Home
  2. CVE Database
  3. CVE-2022-38202
HIGH · 7.5

CVE-2022-38202

There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker traverse the file system to access files o...

Vulnerability Description

There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker traverse the file system to access files outside of the intended directory on ArcGIS Server. This could lead to the disclosure of sensitive site configuration information (not user datasets).

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
EsriArcgis Server<= 10.9.1

Related Weaknesses (CWE)

CWE-22CWE-23

References

FAQ

What is CVE-2022-38202?

CVE-2022-38202 is a vulnerability with a CVSS score of 7.5 (HIGH). There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker traverse the file system to access files o...

How severe is CVE-2022-38202?

CVE-2022-38202 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-38202?

Check the references section above for vendor advisories and patch information. Affected products include: Esri Arcgis Server.