Vulnerability · Published Oct 25, 2022 · Assigned by Esri
CVE-2022-38199BUG-000144172 - Remote file download issue in ArcGIS Server
Medium 6.1
In plain English
A medium-severity security flaw in ArcGIS Server from Esri. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.3%top 74.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. Current browsers provide users with warnings against running unsigned executables downloaded from the internet.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Esri | ArcGIS Server | All – through 10.9.1 |
Weakness: CWE-494 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N