A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify Column properties allowing for the execution of a SQL Injection by a remote authenticated user with elevated (non admin) privileges. There is a high impact to integrity and confidentiality and no impact to availability.
References
| Link | Resource |
|---|---|
| https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/ | Vendor Advisory |
Configurations
History
06 Mar 2025, 14:23
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:esri:arcgis_server:*:*:*:*:*:*:*:* | |
| References | () https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/ - Vendor Advisory | |
| First Time |
Esri arcgis Server
Esri |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.6 |
03 Mar 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-03 20:15
Updated : 2025-03-06 14:23
NVD link : CVE-2024-51962
Mitre link : CVE-2024-51962
JSON object : View
Products Affected
esri
- arcgis_server
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')