CVE-2021-29093
Assigner: Esri
Published: 2021-03-16T00:00:00
State: PUBLISHED
affected: platforms: x64 
product: ArcGIS Server
vendor: Esri 
versions: lessThanOrEqual: 10.9
status: affected
version: All
versionType: custom
datePublic: 2021-03-16T00:00:00
descriptions: value: A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.
metrics: cvssV3_0: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.0
problemTypes: descriptions: cweId: CWE-416
description: CWE-416 Use After Free
type: CWE
source: discovery: INTERNAL
title: ArcGIS Server image service and raster analytics security update: use-after-free
x_generator: engine: Vulnogram 0.0.8