CVE-2023-25838

Katalog CVE

CVSS 7.5 · High EPSS 0,67%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada esri arcgis insights. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

There is SQL injection vulnerability in Esri ArcGIS Insights 2022.1 for ArcGIS Enterprise and that may allow a remote, authorized attacker to execute arbitrary SQL commands against the back-end database. The effort required to generate the crafted input required to exploit this issue is complex and requires significant effort before a successful attack can be expected.

Rincian

Terbit di NVD

19 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-insights-security-patches-for-arc... patch · advisory vendor