PT-2021-5163 · Esri · Esri Arcgis Server

Published 2021-09-23 · Updated 2022-03-30 · CVE-2021-29116

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Esri ArcGIS Server feature services versions 10.8.1 and 10.9

Description The issue is related to a stored Cross Site Scripting (XSS) vulnerability. This vulnerability may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries, potentially executing arbitrary JavaScript code in the user's browser.

Recommendations For Esri ArcGIS Server feature services versions 10.8.1 and 10.9, consider disabling the feature services until a patch is available to prevent the storage and execution of malicious strings. Restrict access to crafted queries to minimize the risk of exploitation. Avoid using the feature services for storing or passing user-input data until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-05963

CVE-2021-29116

Affected Products

Esri Arcgis Server

References · 5

• https://bdu.fstec.ru/vul/2021-05963 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-29116 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29116 · Vendor Advisory
• https://esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-2-patch-is-now-available · Vendor Advisory
• https://t.me/cibsecurity/33431 · Telegram Post