PT-2023-20349 · Esri · Arcgis Enterprise Server

Published 2023-08-25 · Updated 2024-10-08 · CVE-2023-25848

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ArcGIS Enterprise Server versions 11.0 and below

Description The issue allows a remote, unauthorized attacker to submit a crafted query, potentially resulting in a low severity information disclosure. The disclosed information is limited to a single attribute in a database connection string, with no business data being disclosed.

Recommendations For ArcGIS Enterprise Server versions 11.0 and below, update to a version above 11.0 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2023-25848

Affected Products

Arcgis Enterprise Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-25848 · Security Note
• https://esri.com/arcgis-blog/products/trust-arcgis/announcements/arcgis-server-map-and-feature-service-security-2023-update-1-patch · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25848 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1695174340751331573 · Twitter Post
• https://twitter.com/TechFishNews/status/1695173284441248127 · Twitter Post
• https://twitter.com/CVEnew/status/1695147419002904975 · Twitter Post
• https://t.me/cibsecurity/69205 · Telegram Post