Paper/Archive/CVE-2021-29102

CVE-2021-29102

Esri ArcGIS Server — There is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.

EPSS 2%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 75.5.755 × 2015.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks.

Affected

ProductAffectedFixed inSource

ArcGIS ServerAll – < 10.9.010.9.0CNA

Scores by source

Esri (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refesri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch