CVE-2021-29099
There is a SQL injection vulnerability in ArcGIS Server
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue.
Se presenta una vulnerabilidad de inyección SQL en algunas configuraciones de ArcGIS Server versiones 10.8.1 y anteriores. Unas peticiones web especialmente diseñadas pueden exponer información que no se tiene previsto divulgar (no conjuntos de datos de clientes). Los servicios web que utilizan fuentes de datos basadas en archivos (archivos de geodatos o Shape Files o servicios de caché de azulejos) no están afectados por este problema
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-03-23 CVE Reserved
- 2021-06-07 CVE Published
- 2024-01-12 EPSS Updated
- 2024-09-17 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Esri Search vendor "Esri" | Arcgis Server Search vendor "Esri" for product "Arcgis Server" | <= 10.8.1 Search vendor "Esri" for product "Arcgis Server" and version " <= 10.8.1" | - |
Affected
| ||||||