CVE-2024-51961CWE-73

Local file inclusion (LFI) vulnerability in ArcGIS Server

High · published March 3, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
39.6
In the wild
Unconfirmed
What it is

There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server.  Due to the nature of the files accessible in this vulnerability the impact to confidentiality is High there is no impact to both integrity or availability.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00469 · 39.6th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2025-03-03T19:58Z
EPSS history
Timeline
  • 03 MAR 19:58Z
    Local file inclusion (LFI) vulnerability in ArcGIS Server
    cvelistv5