CVE-2024-25693: 
ArcGIS Server vulnerability analysis and mitigation

A path traversal vulnerability has been identified in Esri Portal for ArcGIS versions 11.2 and earlier, tracked as CVE-2024-25693. The vulnerability was disclosed on April 4, 2024, affecting both Windows and Linux installations of Portal for ArcGIS that participate in an ArcGIS Enterprise Site (Vendor Advisory).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and has received a Critical CVSS v3.1 base score of 9.9. The attack vector is network-based (N), requires low attack complexity (L), needs low privileges (L), requires no user interaction (N), and has a changed scope (C) with high impacts on confidentiality, integrity, and availability (NVD).

Successful exploitation of this vulnerability allows a remote, authenticated attacker to traverse the file system to access files or execute code outside of the intended directory. This presents significant risks to system security and data confidentiality (NVD).

The vulnerability requires an authenticated user with network access to exploit. The attack complexity is rated as low, indicating that the vulnerability is relatively straightforward to exploit once access is obtained (Vendor Advisory).

Esri has released Security Patches for Portal for ArcGIS as part of the Portal for ArcGIS Security 2024 Update 1 Patch. System administrators are strongly advised to apply these patches to all affected Portal for ArcGIS machines at their earliest opportunity (Vendor Advisory).