title: BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability
description: Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
vendor: Esri
product: ArcGIS Server
versions:
version: All, status: affected, lessThanOrEqual: 10.9.1, versionType: custom
platforms: x64
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
]
solutions: Install ArcGIS Server Security 2022 Update 1 Patch: https://support.esri.com/en/download/8043