CVE-2021-29115
Assigner: Esri
Published: 2021-12-06T00:00:00
State: PUBLISHED
affected: platforms: x64
product: ArcGIS Server
vendor: Esri
versions: lessThanOrEqual: 10.9.0
status: affected
version: All
versionType: custom
datePublic: 2021-12-06T00:00:00
descriptions: value: An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers. This issue may reveal field names, but not not disclose features.
metrics: cvssV3_0: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.0
problemTypes: descriptions: cweId: CWE-200
description: CWE-200 Information Exposure
type: CWE
source: defect: BUG-000142204
discovery: UNKNOWN
title: An information disclosure vulnerability
workarounds: value: Options to address this issue include securing the hosted feature service and any created views. 
x_generator: engine: Vulnogram 0.0.8