Rejected reason: This submission has been rejected by the CNA of record. Authentication is user configurable as described in our documentation.     https://enterprise.arcgis.com/en/server/latest/administer/windows/configuring-arcgis-server-security.htm

ArcGIS Enterprise Server 10.8.0 allows a remote attacker to obtain sensitive information because /arcgis/rest/services does not require authentication.