CVE-2022-38199 - Vulnerability Details - OpenCVE

A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. Current browsers provide users with warnings against running unsigned executables downloaded from the internet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00504.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Esri	Arcgis Server

Configuration 1 [-]

OR	cpe:2.3:a:esri:arcgis_server:10.7.1::::::x64:
	cpe:2.3:a:esri:arcgis_server:10.8.1::::::x64:
	cpe:2.3:a:esri:arcgis_server:10.9.1::::::x64:

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2022-40792	A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. Current browsers provide users with warnings against running unsigned executables downloaded from the internet.

Fixes

Solution

No solution given by the vendor.

Workaround

Secure ArcGIS Server web services Install ArcGIS Server 2022 Security update 1

References

Link	Providers
https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch

History

Thu, 10 Apr 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Esri

Published: 2022-10-25T16:31:49.102Z

Updated: 2025-04-10T14:56:20.074Z

Reserved: 2022-08-12T00:00:00.000Z

Link: CVE-2022-38199

Vulnrichment

Updated: 2024-08-03T10:45:53.098Z

NVD

Status : Modified

Published: 2022-10-25T17:15:55.473

Modified: 2024-11-21T07:16:02.720

Link: CVE-2022-38199

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-38199", "assignerOrgId": "cedc17bb-4939-4f40-a1f4-30ae8af1094e", "assignerShortName": "Esri", "datePublished": "2022-10-25T16:31:49.102Z", "dateUpdated": "2025-04-10T14:56:20.074Z", "dateReserved": "2022-08-12T00:00:00.000Z"}, "containers": {"cna": {"title": "BUG-000144172 - Remote file download issue in ArcGIS Server", "datePublic": "2022-08-17T00:00:00.000Z", "providerMetadata": {"orgId": "cedc17bb-4939-4f40-a1f4-30ae8af1094e", "shortName": "Esri", "dateUpdated": "2022-10-25T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. Current browsers provide users with warnings against running unsigned executables downloaded from the internet."}], "affected": [{"vendor": "Esri", "product": "ArcGIS Server", "versions": [{"version": "All", "status": "affected", "lessThanOrEqual": "10.9.1", "versionType": "custom"}], "platforms": ["x64"]}], "references": [{"url": "https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch"}], "credits": [{"lang": "en", "value": "Credit: David M. Chavez"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-494 Download of Code Without Integrity Check", "cweId": "CWE-494"}]}], "x_generator": {"engine": "vulnogram 0.1.0-rc1"}, "source": {"defect": ["BUG-000144172"], "discovery": "UNKNOWN"}, "workarounds": [{"lang": "en", "value": "Secure ArcGIS Server web services\nInstall ArcGIS Server 2022 Security update 1"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:45:53.098Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-10T14:49:56.286976Z", "id": "CVE-2022-38199", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-10T14:56:20.074Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:45:53.098Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-38199", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-10T14:49:56.286976Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-10T14:49:58.383Z"}}], "cna": {"title": "BUG-000144172 - Remote file download issue in ArcGIS Server", "source": {"defect": ["BUG-000144172"], "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "value": "Credit: David M. Chavez"}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Esri", "product": "ArcGIS Server", "versions": [{"status": "affected", "version": "All", "versionType": "custom", "lessThanOrEqual": "10.9.1"}], "platforms": ["x64"]}], "datePublic": "2022-08-17T00:00:00.000Z", "references": [{"url": "https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch"}], "workarounds": [{"lang": "en", "value": "Secure ArcGIS Server web services\nInstall ArcGIS Server 2022 Security update 1"}], "x_generator": {"engine": "vulnogram 0.1.0-rc1"}, "descriptions": [{"lang": "en", "value": "A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. Current browsers provide users with warnings against running unsigned executables downloaded from the internet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-494", "description": "CWE-494 Download of Code Without Integrity Check"}]}], "providerMetadata": {"orgId": "cedc17bb-4939-4f40-a1f4-30ae8af1094e", "shortName": "Esri", "dateUpdated": "2022-10-25T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-38199", "state": "PUBLISHED", "dateUpdated": "2025-04-10T14:56:20.074Z", "dateReserved": "2022-08-12T00:00:00.000Z", "assignerOrgId": "cedc17bb-4939-4f40-a1f4-30ae8af1094e", "datePublished": "2022-10-25T16:31:49.102Z", "assignerShortName": "Esri"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:esri:arcgis_server:10.7.1:*:*:*:*:*:x64:*", "matchCriteriaId": "545E7FE7-FC0E-4EEA-996E-47D42BB48BE1", "vulnerable": true}, {"criteria": "cpe:2.3:a:esri:arcgis_server:10.8.1:*:*:*:*:*:x64:*", "matchCriteriaId": "E00E642B-129D-4CA3-BABD-4D200AD86793", "vulnerable": true}, {"criteria": "cpe:2.3:a:esri:arcgis_server:10.9.1:*:*:*:*:*:x64:*", "matchCriteriaId": "5A2B2FAE-B96F-4663-B303-BA6654F2EA37", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. Current browsers provide users with warnings against running unsigned executables downloaded from the internet."}, {"lang": "es", "value": "Puede producirse un problema de descarga remota de archivos en algunas capacidades de los servicios web de Esri ArcGIS Server que, en algunos casos extremos, puede permitir a un atacante remoto no autenticado inducir a una v\u00edctima desprevenida a iniciar un proceso en el entorno PATH de la v\u00edctima. Los navegadores actuales proporcionan a usuarios advertencias contra la ejecuci\u00f3n de ejecutables no firmados descargados de Internet"}], "id": "CVE-2022-38199", "lastModified": "2024-11-21T07:16:02.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "psirt@esri.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-10-25T17:15:55.473", "references": [{"source": "psirt@esri.com", "tags": ["Vendor Advisory"], "url": "https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch"}], "sourceIdentifier": "psirt@esri.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-494"}], "source": "psirt@esri.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-494"}], "source": "nvd@nist.gov", "type": "Primary"}]}