Vulnerability · Published May 5, 2021 · Assigned by Esri
CVE-2021-29101ArcGIS GeoEvent Server has a Directory Traversal security vulnerability.
High 8.6
In plain English
A high-severity security flaw in ArcGIS GeoEvent Server from Esri. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities).
Severity (CVSS 3.0)8.6High
Exploit odds (30 days)2.3%top 16.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ArcGIS GeoEvent Server versions 10.8.1 and below has a read-only directory path traversal vulnerability that could allow an unauthenticated, remote attacker to perform directory traversal attacks and read arbitrary files on the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Esri | ArcGIS GeoEvent Server | All – through 10.8.1 |
Weakness: CWE-23 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N