Elwood Buck

The issue allows Local File Inclusion. The samples library, included by default in the appstart.sas file, enables end-users to access the sample.webcsf1.sas program. This program contains user-controlled macro variables passed to the DS2CSF macro. Users can escape the context of the configured user-controllable variable and append additional functions native to the macro but not included as variables within the library. This includes a function that retrieves files from the host OS.

Name of the Vulnerable Software and Affected Versions: ArcGIS Server versions 10.8.1 and earlier Description: A SQL injection issue exists in some configurations, allowing specially crafted web requests to expose unintended information. This does not affect customer datasets. Web Services using file-based data sources, such as file Geodatabase, Shape Files, or tile cached services, are not affected by this issue. Recommendations: For ArcGIS Server versions 10.8.1 and earlier, consider restricting access to sensitive data until a fix is available. As a temporary workaround, review and secure web request handling to prevent exploitation of the SQL injection issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A stored XSS issue affects the software via multiple input fields, including `Login Message`, `Banner Message`, and `Password Instructions`, of the `com.threeis.webta.H261configMenu` servlet. This can be exploited by an authenticated administrator.

The issue concerns a Stored XSS vulnerability. It can be triggered by setting the Application Banner input field of the "/ApplicationBanner" page as an authenticated administrator.