title: ArcGIS GeoEvent Server has a Directory Traversal security vulnerability.
description: ArcGIS GeoEvent Server versions 10.8.1 and below has a read-only directory path traversal vulnerability that could allow an unauthenticated, remote attacker to perform directory traversal attacks and read arbitrary files on the system.
problem types: CWE-23 Relative Path Traversal
affected:
{
platforms: x64
product: ArcGIS GeoEvent Server
vendor: Esri
versions:
lessThanOrEqual: 10.8.1, status: affected, version: All, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.0
]
solutions: Esri has released a patch to address this issue.