CVE-2023-25838: BUG-000157278 – ArcGIS Insights has a security vulnerability.

Published Jul 19, 2023

Updated

There is SQL injection vulnerability in Esri ArcGIS Insights 2022.1 for ArcGIS Enterprise and that may allow a remote, authorized attacker to execute arbitrary SQL commands against the back-end database. The effort required to generate the crafted input required to exploit this issue is complex and requires significant effort before a successful attack can be expected.

Affected Software

2 affected components

Esri Arcgis Insights Arcgis Enterprise=2022.1

Esri ArcGIS Insights=2022.1

Remediation

Patch Available

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-insights-security-patches-for-arcgis-insights-2022-1-are-now-available/

Event History

Jul 19, 2023

CVE Published

via MITRE·03:37 PM

Data Sourced

via MITRE·03:37 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2023-25838?

CVE-2023-25838 is a SQL injection vulnerability in Esri ArcGIS Insights 2022.1 for ArcGIS Enterprise that allows a remote, authorized attacker to execute arbitrary SQL commands against the back-end database.

What is the severity of CVE-2023-25838?

CVE-2023-25838 has a severity rating of high.

How can an attacker exploit CVE-2023-25838?

CVE-2023-25838 can be exploited by a remote, authorized attacker who crafts malicious input to execute SQL commands against the back-end database.

Is there a patch or fix available for CVE-2023-25838?

Yes, patches for CVE-2023-25838 are available for ArcGIS Insights 2022.1 for ArcGIS Enterprise.

Where can I find more information about CVE-2023-25838?

You can find more information about CVE-2023-25838 on the Esri ArcGIS blog.