Vulnerability · Published May 5, 2021 · Assigned by Esri
CVE-2021-29100ArcGIS Earth has a File Parsing Directory Traversal Vulnerability
High 7.8
In plain English
A high-severity security flaw in ArcGIS Earth from Esri. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).
Severity (CVSS 3.0)7.8High
Exploit odds (30 days)1.1%top 33.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A path traversal vulnerability exists in Esri ArcGIS Earth versions 1.11.0 and below which allows arbitrary file creation on an affected system through crafted input. An attacker could exploit this vulnerability to gain arbitrary code execution under security context of the user running ArcGIS Earth by inducing the user to upload a crafted file to an affected system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Esri | ArcGIS Earth | 1.11 – before 1.11.2903 |
Weakness: CWE-23 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H