cve/2023/CVE-2023-25848.md

### [CVE-2023-25848](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25848)
![](https://img.shields.io/static/v1?label=Product&message=Server&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%2010.8.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-319%20Cleartext%20Transmission%20of%20Sensitive%20Information&color=brighgreen)

### Description

ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue. The information disclosed is limited to a single attribute in a database connection string. No business data is disclosed.

### POC

#### Reference
- https://www.esri.com/arcgis-blog/products/trust-arcgis/announcements/arcgis-server-map-and-feature-service-security-2023-update-1-patch/

#### Github
No PoCs found on GitHub currently.