A security scan of an application I maintain that uses several ArcGIS 10.7.1 map services (hosted with stand alone ArcGIS Server, not Enterprise, on AWS server, with IIS as web server) produced this warning for all of the map services:
Oracle Application Server PL/SQL Unauthorized SQL Query Execution It is possible to view, modify or delete database entries and tables.
I should note that we do not use Oracle databases. I assume this error is related to ArcGIS Server configuration (Apache Tomcat ?) All the map services are read-only and supported by file gdbs.
The report suggests this to remediate: Block unauthenticated PUBLIC access to PL/SQL procedures and applications by adding the following rule to the file "$ORACLE_HOME$\Apache\modplsql\cfg\wdbsvr.app":
exclusion_list= account*, sys., dbms_, owa*
Has anyone encountered this problem? I have never modified any internal configuration to ArcGIS Server.