CVE-2024-51958

{"id": "CVE-2024-51958", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "psirt@esri.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2025-03-03T20:15:42.397", "references": [{"url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/", "tags": ["Vendor Advisory"], "source": "psirt@esri.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@esri.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "There is a path traversal vulnerability in ESRI ArcGIS Server versions 10.9.1 thru 11.3. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory.\u00a0 There is no impact to integrity or availability due to the nature of the files that can be accessed, but there is a potential high impact to confidentiality."}, {"lang": "es", "value": "Existe una vulnerabilidad de path traversal en las versiones 10.9.1 a 11.3 de ESRI ArcGIS Server. Si se explota con \u00e9xito, es posible que un atacante remoto autenticado con privilegios de administrador pueda recorrer el sistema de archivos para acceder a archivos fuera del directorio previsto. No hay impacto en la integridad ni en la disponibilidad debido a la naturaleza de los archivos a los que se puede acceder, pero existe un alto potencial de impacto en la confidencialidad."}], "lastModified": "2025-03-06T14:23:26.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:esri:arcgis_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F9FCA91-B1DE-4C4E-8E33-C42BEA8F53D0", "versionEndIncluding": "11.3", "versionStartIncluding": "10.9.1"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@esri.com"}