CVE-2025-1726: [#BUG-000172669 ArcGIS Monitor has a security vulnerability]
First published: Wed Feb 26 2025(Updated: )
There is a SQL injection issue in Esri ArcGIS Monitor versions 2023.0 through 2024.x on Windows and Linux that allows a remote, authenticated attacker with low privileges to improperly read limited database schema information by passing crafted queries. While it is possible to enumerate some internal database identifiers, the impact to the confidentiality vector is "LOW' because any sensitive data returned in a response is encrypted. There is no evidence of impact to the integrity or availability vectors. This issue is addressed in ArcGIS Monitor 2024.1.
Credit: psirt@esri.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Esri ArcGIS Monitor | >=2023.0<2024.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-1726?
CVE-2025-1726 has been classified as a medium severity vulnerability.
How do I fix CVE-2025-1726?
To mitigate CVE-2025-1726, upgrade Esri ArcGIS Monitor to version 2024.1 or later.
What systems are affected by CVE-2025-1726?
CVE-2025-1726 affects Esri ArcGIS Monitor versions 2023.0 through 2024.x on both Windows and Linux environments.
What type of vulnerability is CVE-2025-1726?
CVE-2025-1726 is a SQL injection vulnerability that allows unauthorized access to limited database schema information.
Who can exploit CVE-2025-1726?
CVE-2025-1726 can be exploited by remote, authenticated attackers with low privileges.
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/first-publish-date
- agent/severity
- agent/type
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/title
- agent/author
- agent/source
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/esri
- canonical/esri arcgis monitor