CVE-2021-29093: medium-severity vulnerability in Esri ArcGIS Server
ArcGIS Server image service and raster analytics security update: use-after-free
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A memory error in ArcGIS Server allows an authenticated attacker with special permissions to run malicious code by uploading a specially crafted file. The flaw exists because the software tries to use memory that has already been freed.
Use-after-free vulnerability in ArcGIS Server 10.8.1 and earlier triggered during file parsing. Attack vector requires authentication and specialized permissions; successful exploitation results in arbitrary code execution with service account privileges. The vulnerability stems from improper memory management of parsed file data.
In the same product, most dangerous first.