PT-2025-8739 · Esri · Esri Arcgis Monitor

Published 2025-02-26 · Updated 2025-02-26 · CVE-2025-1726

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Esri ArcGIS Monitor versions 2023.0 through 2024.x

Description The issue is a SQL injection problem that allows a remote, authenticated attacker with low privileges to improperly read limited database schema information by passing crafted queries. Although it is possible to enumerate some internal database identifiers, the impact to confidentiality is considered low because any sensitive data returned in a response is encrypted. There is no evidence of impact to integrity or availability.

Recommendations For Esri ArcGIS Monitor versions 2023.0 through 2024.x, update to version 2024.1 to address the issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-1726

Affected Products

Esri Arcgis Monitor

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-1726 · Security Note
• https://esri.com/arcgis-blog/products/monitor/administration/whats-new-in-arcgis-monitor-2024-1 · Note
• https://twitter.com/CVEnew/status/1894867660887990755 · Twitter Post
• https://t.me/cvedetector/18959 · Telegram Post