CVE-2021-29114: high-severity vulnerability in Esri ArcGIS Server
SQL injection vulnerability in ArcGIS Server
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.3epss 1.0%
In short
ArcGIS Server versions 10.9 and below have a SQL injection flaw in their feature services that lets attackers send specially crafted requests to steal, modify, or delete database information without needing to log in.
Technical detail
SQL injection vulnerability in ArcGIS Server feature services (v10.9 and below) allows unauthenticated remote attackers to execute arbitrary SQL commands through maliciously crafted queries, compromising confidentiality, integrity, and availability of backend databases.
Summary generated and translated by AI from the official description.
A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
Esri · ArcGIS ServerRelated CVEs — Esri ArcGIS Server
In the same product, most dangerous first.
CVE-2021-29115MEDIUMAn information disclosure vulnerabilityEPSS 2.2%CVE-2021-29102CRITICALThere is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.EPSS 1.6%CVE-2022-38202HIGHBUG-000152121 - Directory traversal vulnerability in ArcGIS Server.EPSS 1.4%CVE-2026-9181CRITICALDirectory Traversal in ArcGIS ServerEPSS 1.2%CVE-2022-38196MEDIUMBUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerabilityEPSS 1.2%CVE-2021-29094MEDIUMArcGIS Server image service and raster analytics security update: buffer overflowEPSS 1.0%