CVE-2021-29107: medium-severity vulnerability in Esri ArcGIS Server
There is a stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below.
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in ArcGIS Server Manager allows attackers to store malicious code that gets executed in other users' browsers when they access the application. This can lead to account compromise or data theft.
Stored XSS vulnerability in ArcGIS Server Manager ≤10.8.1 permits unauthenticated remote attackers to inject and persist malicious JavaScript via unvalidated input fields. When authenticated users view contaminated content, the payload executes in their browser context, enabling session hijacking, credential theft, or administrative actions.
In the same product, most dangerous first.