Lucene search

EsriCVE-2023-25848

HistoryAug 25, 2023 - 7:15 p.m.

CVE-2023-25848

2023-08-2519:15:08

CWE-319

Esri

web.nvd.nist.gov

cve-2023-25848

arcgis enterprise server

information disclosure

vulnerability

database connection string

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

27.9%

JSON

ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue.

The information disclosed is limited to a single attribute in a database connection string. No business data is disclosed.

Affected configurations

Nvd

Node

esriarcgis_serverRange10.8.1–11.0

VendorProductVersionCPE
esriarcgis_server*cpe:2.3:a:esri:arcgis_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
esri	arcgis_server	*	cpe:2.3:a:esri:arcgis_server::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "x86"
    ],
    "product": "Server",
    "vendor": "Esri",
    "versions": [
      {
        "status": "affected",
        "version": "10.8.1"
      },
      {
        "status": "affected",
        "version": "10.9.1"
      },
      {
        "status": "affected",
        "version": "11.0"
      },
      {
        "status": "affected",
        "version": "11.1"
      }
    ]
  }
]

References

www.esri.com/arcgis-blog/products/trust-arcgis/announcements/arcgis-server-map-and-feature-service-security-2023-update-1-patch/

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

27.9%

JSON

Related for CVE-2023-25848