Описание
A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.
Ссылки
- MitigationVendor Advisory
Уязвимые конфигурации
Одновременно
Одно из
EPSS
10 Critical
CVSS3
Дефекты
Связанные уязвимости
A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.
Уязвимость сервера ArcGIS Server, связанная с непринятием мер по защите структуры запроса SQL, позволяющая нарушителю выполнить произвольные SQL-команды
EPSS
10 Critical
CVSS3