ESRI ArcGIS for Server CVE-2013-5222 Multiple Input Validation Vulnerabilities

Bugtraq ID:	62889
Class:	Input Validation Error
CVE:	CVE-2013-5222 CVE-2013-7232 CVE-2013-7231
Remote:	Yes
Local:	No
Published:	Sep 05 2013 12:00AM
Updated:	Dec 31 2013 12:49AM
Credit:	Vendor, Roberto Suggi Liverani and NCIA-NCIRC
Vulnerable:
Not Vulnerable:

ESRI ArcGIS for Server CVE-2013-5222 Multiple Input Validation Vulnerabilities

ESRI ArcGIS for Server is prone to the following multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input:

1. An unspecified cross-site scripting vulnerability
2. An HTML-injection vulnerability
3. Multiple SQL-injection vulnerabilities

Attackers can exploit these issues to execute arbitrary code in the context of the browser, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database; other attacks are also possible.

ESRI ArcGIS for Server 10.1 SP1 and 10.2 are vulnerable.

ESRI ArcGIS for Server CVE-2013-5222 Multiple Input Validation Vulnerabilities

An attacker can use a browser to exploit these issues. An attacker must trick a victim into following a malicious URI to exploit cross-site scripting issues.

ESRI ArcGIS for Server CVE-2013-5222 Multiple Input Validation Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

ESRI ArcGIS for Server CVE-2013-5222 Multiple Input Validation Vulnerabilities

References: