nvd-json-data-feeds/CVE-2025/CVE-2025-17xx/CVE-2025-1726.json

{
  "id": "CVE-2025-1726",
  "sourceIdentifier": "psirt@esri.com",
  "published": "2025-02-26T20:15:13.510",
  "lastModified": "2025-02-26T20:15:13.510",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is a SQL injection issue\u00a0in Esri ArcGIS Monitor versions 2023.0 through 2024.x on Windows and Linux that allows a remote, authenticated attacker with low privileges to improperly read limited database schema information by passing crafted queries. While it is possible to enumerate some internal database identifiers, the impact to the confidentiality vector is \"LOW' because any sensitive data returned in a response is encrypted. There is no evidence of impact to the integrity or availability vectors. This issue is addressed in ArcGIS Monitor 2024.1."
    },
    {
      "lang": "es",
      "value": "Existe un problema de inyecci\u00f3n SQL en las versiones 2023.0 a 2024.x de Esri ArcGIS Monitor en Windows y Linux que permite que un atacante remoto autenticado con privilegios bajos lea de forma incorrecta informaci\u00f3n limitada del esquema de la base de datos mediante consultas manipuladas. Si bien es posible enumerar algunos identificadores de base de datos internos, el impacto en el vector de confidencialidad es \"BAJO\" porque cualquier dato confidencial devuelto en una respuesta est\u00e1 cifrado. No hay evidencia de impacto en los vectores de integridad o disponibilidad. Este problema se soluciona en ArcGIS Monitor 2024.1."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "psirt@esri.com",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ]
  },
  "weaknesses": [
    {
      "source": "psirt@esri.com",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.esri.com/arcgis-blog/products/monitor/administration/whats-new-in-arcgis-monitor-2024-1/",
      "source": "psirt@esri.com"
    }
  ]
}