CVE-2021-29095CWE-824

ArcGIS Server image service and raster analytics security update: uninitialized pointer

Medium · published March 25, 2021

CVSS v3.0
6.4
EPSS
1%
Percentile
59.7
In the wild
Unconfirmed
What it is

Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.

The record
Technical detail
CVSS v3.0
6.4 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00914 · 59.7th percentile
Weakness
CWE-824 · Access of Uninitialized Pointer
Published
2021-03-25T20:34Z
EPSS history
Timeline
  • 25 MAR 20:34Z
    ArcGIS Server image service and raster analytics security update: uninitialized pointer
    cvelistv5