Security readout for executives and security teams
Plain-English summary
ArcGIS Insights Desktop 2022.1 for Mac and Windows has a SQL injection flaw. A local, authorized user could potentially run unauthorized SQL against the product’s back-end database. The issue is rated high because database confidentiality, integrity, and availability may be impacted, but exploitation is local and described as complex.
Executive priority
Treat this as a targeted high-severity desktop risk, not an internet-wide emergency. Patch affected 2022.1 installations promptly, especially where Insights connects to sensitive operational or customer data.
Technical view
CVE-2023-25839 is CWE-89 SQL injection in Esri ArcGIS Insights Desktop 2022.1. The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0. Sources describe arbitrary SQL command execution against the back-end database by a local authorized attacker.
Likely exposure
Exposure is limited to organizations running Esri ArcGIS Insights Desktop version 2022.1 on Mac or Windows. The source record identifies other versions as unaffected by default, but teams should verify installed versions against Esri guidance.
Exploitation context
The CVE is not listed as KEV in the supplied bundle, and no cited source states active exploitation. Exploitation requires local access, low privileges, no user interaction, and complex crafted input requiring significant effort.
Researcher notes
The record gives product, version, platform, CWE, and CVSS details, but the bundle does not include exploit proof, indicators of compromise, or exact fixed build numbers. Avoid assuming remote reachability or active exploitation without additional vendor evidence.
Mitigation direction
- Apply Esri security patches for ArcGIS Insights 2022.1 from vendor guidance.
- Inventory Mac and Windows endpoints for ArcGIS Insights Desktop 2022.1.
- Restrict local access to systems running the affected desktop application.
- Prioritize patching where local users can access sensitive Insights databases.
- Monitor Esri advisories for any additional fixed-version or workaround details.
Validation and detection
- Confirm whether ArcGIS Insights Desktop 2022.1 is installed on Mac or Windows endpoints.
- Verify patched systems no longer report the vulnerable 2022.1 build.
- Review endpoint access controls for users allowed to run Insights Desktop.
- Check database audit logs for unusual local application-originated SQL activity.
- Document patch status and exceptions in vulnerability management records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-25839 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.