CVE-2021-29100CWE-23

ArcGIS Earth has a File Parsing Directory Traversal Vulnerability

High · published May 5, 2021

CVSS v3.0
7.8
EPSS
1%
Percentile
66.3
In the wild
Unconfirmed
What it is

A path traversal vulnerability exists in Esri ArcGIS Earth versions 1.11.0 and below which allows arbitrary file creation on an affected system through crafted input. An attacker could exploit this vulnerability to gain arbitrary code execution under security context of the user running ArcGIS Earth by inducing the user to upload a crafted file to an affected system.

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01138 · 66.3th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2021-05-05T15:16Z
EPSS history
Timeline
  • 05 MAY 15:16Z
    ArcGIS Earth has a File Parsing Directory Traversal Vulnerability
    cvelistv5