CVE-2024-25693 CRITICAL

CVE-2024-25693: Portal for ArcGIS has a directory traversal vulnerability.

Vendor Esri
Product Portal for ArcGIS
Weakness CWE-22 · Path traversal
Published April 4, 2024
Last update August 1, 2024

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Successful exploitation may allow a remote, authenticated attacker to traverse the file system to access files or execute code outside of the intended directory. 

Key dates

02Disclosure timeline

April 4, 2024 CVE published
August 1, 2024 Record updated