CVE-2021-29094CWE-120

ArcGIS Server image service and raster analytics security update: buffer overflow

Medium · published March 25, 2021

CVSS v3.0
6.4
EPSS
1%
Percentile
63.6
In the wild
Unconfirmed
What it is

Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.

The record
Technical detail
CVSS v3.0
6.4 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01038 · 63.6th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2021-03-25T20:33Z
EPSS history
Timeline
  • 25 MAR 20:33Z
    ArcGIS Server image service and raster analytics security update: buffer overflow
    cvelistv5