CVE-2021-29099CWE-89

There is a SQL injection vulnerability in ArcGIS Server

Medium · published June 7, 2021

CVSS v3.0
5.3
EPSS
1%
Percentile
49.7
In the wild
Unconfirmed
What it is

A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00633 · 49.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2021-06-07T11:47Z
EPSS history
Timeline
  • 07 JUN 11:47Z
    There is a SQL injection vulnerability in ArcGIS Server
    cvelistv5