2 lines
2.8 KiB
JSON
2 lines
2.8 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","Linux"],"product":"ArcGIS Server","vendor":"Esri","versions":[{"lessThanOrEqual":"12.0","status":"affected","version":"11.1","versionType":"custom"}]}],"source":"psirt@esri.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:esri:arcgis_server:*:*:*:*:*:*:*:*","matchCriteriaId":"330075C0-D0B5-40C9-B384-37764EB8D139","versionEndIncluding":"12.0","versionStartIncluding":"11.1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1","vulnerable":false},{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issue by sending a crafted request to the endpoint. Successful exploitation may result in disruption of the web-based browsing interface. This issue affects ArcGIS Server 12.0 and earlier."},{"lang":"es","value":"ArcGIS Server contiene una vulnerabilidad de autenticación impropia en un endpoint administrativo no documentado. Un atacante no autenticado podría explotar este problema enviando una solicitud especialmente diseñada al endpoint. La explotación exitosa podría resultar en la interrupción de la interfaz de navegación basada en web. Este problema afecta a ArcGIS Server 12.0 y versiones anteriores."}],"id":"CVE-2026-2812","lastModified":"2026-07-23T12:10:00.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@esri.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-2812","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-20T19:30:27.592167Z","version":"2.0.3"}}]},"published":"2026-05-20T20:16:36.930","references":[{"source":"psirt@esri.com","tags":["Vendor Advisory"],"url":"https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin"}],"sourceIdentifier":"psirt@esri.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@esri.com","type":"Secondary"}]}
|