Description

Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.

Related CPE's

a

esri

arcgis_server

Vulnerable

References

https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/security-advisory-server-image

Vendor Advisory

Weaknesses

[email protected]

Primary
CWE-824

[email protected]

Secondary
CWE-824

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

6.8 · Medium

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2021-03-25T21:15:13.357

4 years ago

Last modified

2024-02-23T19:38:04.767

1 year ago