Vulnerability · Published Oct 1, 2021 · Assigned by Esri
CVE-2021-29108There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below.
High 8.8
In plain English
A high-severity security flaw in Portal for ArcGIS from Esri. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Official description
There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account (XML Signature Wrapping Attack). In addition patching, Esri also strongly recommends as best practice for SAML assertions to be signed and encrypted.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Esri | Portal for ArcGIS | 10.9.0 – before <10.9.0 |
Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H