Esri ArcGIS Monitor SQL Injection Vulnerability Allowing Database Schema Enumeration

A SQL injection vulnerability has been identified in Esri ArcGIS Monitor versions 2023.0 prior to 2024.x, on both Windows and Linux. This vulnerability allows remote, authenticated attackers with low privileges to improperly access limited database schema information by sending crafted queries. While it is possible to enumerate some internal database identifiers, the risk to confidentiality is considered low, as any sensitive data retrieved is encrypted. There is no known impact on integrity or availability.

Impact

Exploitation of this vulnerability could lead to unauthorized access to certain database schema information, including internal database identifiers, which could be misused in conjunction with other vulnerabilities or information to escalate privileges or cause harm to the system.

Remediation

Users can upgrade to ArcGIS Monitor version 2024.1 to address this vulnerability.