PT-2013-6299 · Esri · Esri Arcgis For Server

Published 2013-12-30 · Updated 2024-07-11 · CVE-2013-7232

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ESRI ArcGIS for Server versions through 10.2

Description The issue allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service. This can be exploited by providing malicious input to the service, potentially leading to unauthorized access or data manipulation.

Recommendations For ESRI ArcGIS for Server versions through 10.2, update to a version later than 10.2 to resolve the issue. As a temporary workaround, consider restricting access to the map or feature service to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2013-7232

Affected Products

Esri Arcgis For Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-7232 · Security Note
• http://support.esri.com/en/downloads/patches-servicepacks/view/productid/66/metaid/2009 · Vendor Advisory
• https://t.me/cvenotify/85927 · Telegram Post