ArcGIS Server vulnerabilities
10 known vulnerabilities in ArcGIS Server from Esri. 10 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
ArcGIS Server: Uncontrolled Resource Consumption
There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny servi
- 9.8 Critical severity
ArcGIS Server: Improper Neutralization of Special Elements used in an SQL Command
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access c
- 9.8 Critical severity
ArcGIS Server: Unrestricted Upload of File with Dangerous Type
Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing fo
- 7.5 High severity
ArcGIS Server: Improper Limitation of a Pathname to a Restricted Directory
Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful exploitation could allow overwriting sensitive
- 10.0 Critical severity
ArcGIS Server: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service opera
- 8.7 High severity
ArcGIS Server: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed by a remote authenticated user requiring elevated, non‑administrative privileges. Exploitation is re
- 7.5 High severity
ArcGIS Server: Externally Controlled Reference to a Resource in Another Sphere
There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server.
- 8.5 High severity
ArcGIS Server: Improper Access Control
There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker to access secure services published to a standalone (unfedera
- 7.5 High severity
ArcGIS Server: Improper Limitation of a Pathname to a Restricted Directory
There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker traverse the file system to access files outside of the intended directory on ArcGIS Server. This coul
- 8.1 High severity
ArcGIS Server: Improper Limitation of a Pathname to a Restricted Directory
Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory.