FKIE_CVE-2025-1726

Vulnerability from fkie_nvd - Published: 2025-02-26 20:15 - Updated: 2026-04-15 00:35
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
There is a SQL injection issue in Esri ArcGIS Monitor versions 2023.0 through 2024.x on Windows and Linux that allows a remote, authenticated attacker with low privileges to improperly read limited database schema information by passing crafted queries. While it is possible to enumerate some internal database identifiers, the impact to the confidentiality vector is "LOW' because any sensitive data returned in a response is encrypted. There is no evidence of impact to the integrity or availability vectors. This issue is addressed in ArcGIS Monitor 2024.1.
References
psirt@esri.comhttps://www.esri.com/arcgis-blog/products/monitor/administration/whats-new-in-arcgis-monitor-2024-1/
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is a SQL injection issue\u00a0in Esri ArcGIS Monitor versions 2023.0 through 2024.x on Windows and Linux that allows a remote, authenticated attacker with low privileges to improperly read limited database schema information by passing crafted queries. While it is possible to enumerate some internal database identifiers, the impact to the confidentiality vector is \"LOW\u0027 because any sensitive data returned in a response is encrypted. There is no evidence of impact to the integrity or availability vectors. This issue is addressed in ArcGIS Monitor 2024.1."
    },
    {
      "lang": "es",
      "value": "Existe un problema de inyecci\u00f3n SQL en las versiones 2023.0 a 2024.x de Esri ArcGIS Monitor en Windows y Linux que permite que un atacante remoto autenticado con privilegios bajos lea de forma incorrecta informaci\u00f3n limitada del esquema de la base de datos mediante consultas manipuladas. Si bien es posible enumerar algunos identificadores de base de datos internos, el impacto en el vector de confidencialidad es \"BAJO\" porque cualquier dato confidencial devuelto en una respuesta est\u00e1 cifrado. No hay evidencia de impacto en los vectores de integridad o disponibilidad. Este problema se soluciona en ArcGIS Monitor 2024.1."
    }
  ],
  "id": "CVE-2025-1726",
  "lastModified": "2026-04-15T00:35:42.020",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "psirt@esri.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-02-26T20:15:13.510",
  "references": [
    {
      "source": "psirt@esri.com",
      "url": "https://www.esri.com/arcgis-blog/products/monitor/administration/whats-new-in-arcgis-monitor-2024-1/"
    }
  ],
  "sourceIdentifier": "psirt@esri.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "psirt@esri.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.