ArcGIS ServerにSQLインジェクションの脆弱性、パッチ提供
Summary
Esriの地図・空間情報基盤ArcGIS Serverに、データベースへ不正な命令を通せる脆弱性が見つかり、パッチが出ました。社内外にサービスを公開している組織は、版の確認と、匿名で使えるサービスの洗い出しから始めてください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
Esriの地図・空間情報基盤ArcGIS Serverに、データベースへ不正な命令を通せる脆弱性が見つかり、パッチが出ました。社内外にサービスを公開している組織は、版の確認と、匿名で使えるサービスの洗い出しから始めてください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Esri | ArcGIS Server |
≥ 11.1, < 12.1 |
12.1 |
Original description The description as published by the source.
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web psirt@esri.com
- web nvd.nist.gov
- web github.com