Vulnerability · Published Aug 25, 2023 · Assigned by Esri
CVE-2023-25848BUG-000158039 - There is an information disclosure issue in ArcGIS Server.
Medium 5.3
In plain English
A medium-severity security flaw in ArcGIS Enterprise Server from Esri. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 78.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue. The information disclosed is limited to a single attribute in a database connection string. No business data is disclosed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Esri | ArcGIS Enterprise Server | 10.8.110.9.111.011.1 |
Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N