title: SQL injection vulnerability in ArcGIS Server
description: A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries.
problem types: CWE-89 SQL Injection
affected:
{
platforms: x64
product: ArcGIS Server
vendor: Esri
versions:
lessThan: 10.9.0, status: affected, version: All, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.0
]
workarounds: Mitigating measures:
Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue.
By default, services published to ArcGIS Enterprise are not available anonymously and those services cannot be accessed by an unauthenticated attacker.
Database accounts should be configured using the principle of least privilege.