CVE-2021-29115mediumCWE-200

CVE-2021-29115: medium-severity vulnerability in Esri ArcGIS Server

An information disclosure vulnerability

Published · Updated

Follow this CVE+ Monitor ArcGIS Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 2.2%
In short

A flaw in ArcGIS Service Directory allows attackers to see hidden field names in feature layers without needing special access. While field names are exposed, the actual data within those fields remains protected.

Technical detail

An information disclosure vulnerability in ArcGIS Service Directory (versions 10.9.0 and earlier) permits unauthenticated remote access to enumerate hidden field metadata in feature layers via directory traversal or API inspection. The exposure is limited to field nomenclature; feature records and their values are not compromised, reducing overall impact.

Summary generated and translated by AI from the official description.
An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers. This issue may reveal field names, but not not disclose features.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Esri · ArcGIS Server
Related CVEs — Esri ArcGIS Server

In the same product, most dangerous first.

CVE-2021-29102CRITICALThere is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.EPSS 1.6%CVE-2022-38202HIGHBUG-000152121 - Directory traversal vulnerability in ArcGIS Server.EPSS 1.4%CVE-2026-9181CRITICALDirectory Traversal in ArcGIS ServerEPSS 1.2%CVE-2022-38196MEDIUMBUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerabilityEPSS 1.2%CVE-2021-29114HIGHSQL injection vulnerability in ArcGIS ServerEPSS 1.0%CVE-2021-29094MEDIUMArcGIS Server image service and raster analytics security update: buffer overflowEPSS 1.0%