BUG-000158039 - There is an information disclosure issue in ArcGIS Server.
CVE-2023-25848

5.3MEDIUM

Key Information:

Vendor

Esri

Status
Arcgis Enterprise Server
Vendor
CVE Published:
25 August 2023

What is CVE-2023-25848?

ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue.

The information disclosed is limited to a single attribute in a database connection string. No business data is disclosed.

Affected Version(s)

ArcGIS Enterprise Server x86 10.8.1

ArcGIS Enterprise Server x86 10.9.1

ArcGIS Enterprise Server x86 11.0

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/an...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-25848 : BUG-000158039 - There is an information disclosure issue in ArcGIS Server.