CVE-2021-29113: medium-severity vulnerability in Esri ArcGIS Server
Remote file inclusion vulnerability in ArcGIS Server help documentation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A security flaw in ArcGIS Server's help documentation allows attackers to inject malicious HTML code into web pages without needing to log in. This could trick users into visiting compromised pages or stealing their information.
Remote file inclusion vulnerability in ArcGIS Server help documentation permits unauthenticated attackers to inject arbitrary HTML content via request manipulation. The attack vector is web-based and requires no authentication; successful exploitation results in HTML injection, enabling phishing, credential theft, or malware distribution to end users accessing the help section.
In the same product, most dangerous first.