CVE-2021-29101: high-severity vulnerability in Esri ArcGIS GeoEvent Server
ArcGIS GeoEvent Server has a Directory Traversal security vulnerability.
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
ArcGIS GeoEvent Server versions 10.8.1 and earlier have a flaw that lets remote attackers read any file on the system without needing to log in. An attacker can manipulate file paths to access sensitive information stored on the server.
An unauthenticated remote attacker can exploit a directory traversal vulnerability (CWE-23) in ArcGIS GeoEvent Server ≤10.8.1 to read arbitrary files by manipulating path traversal sequences in requests. The vulnerability is read-only, limiting direct system modification, but enables information disclosure of sensitive files on the affected system.