PT-2025-21140 · Esri · Arcgis

Erez Kalman + 1 · Published 2025-05-14 · Updated 2025-05-17 · CVE-2025-0020

Positive Technologies (AI Summary)

CVSS v4.0

7.9

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:Amber

Name of the Vulnerable Software and Affected Versions: ArcGIS (affected versions not specified)

Description: The ArcGIS client credentials OAuth 2.0 API implementation does not adhere to the RFC/standards, allowing a requestor to request an undocumented, custom token expiration from ArcGIS. This hidden functionality enables privilege abuse, manipulating hidden fields, and configuration/environment manipulation.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Hidden Functionality

Weakness Enumeration

CWE-912

CWE-657

CWE-684

Related Identifiers

CVE-2025-0020

Affected Products

Arcgis

References · 10

• 🔥 https://vulsec.org/advisories · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-0020 · Security Note
• https://t.me/latest_high_impact_cve/2361 · Telegram Post
• https://twitter.com/CALIVEDATA/status/1923578115650978018 · Twitter Post
• https://twitter.com/SpaceCyberSec/status/1923619700237533515 · Twitter Post
• https://twitter.com/CVEnew/status/1922695653458845835 · Twitter Post
• https://developers.arcgis.com/documentation/security-and-authentication · Note
• https://t.me/cvetracker/23813 · Telegram Post
• https://t.me/cvenotify/122284 · Telegram Post
• https://t.me/cvenotify/122093 · Telegram Post