CVE-2021-29102: There is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below.
A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-29102?
CVE-2021-29102 is a Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below.
How does CVE-2021-29102 affect ArcGIS Server Manager?
CVE-2021-29102 may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks.
What is the severity of CVE-2021-29102?
CVE-2021-29102 has a severity level of critical with a CVSS score of 9.1.
Which versions of ArcGIS Server Manager are affected by CVE-2021-29102?
ArcGIS Server Manager version 10.8.1 and below are affected by CVE-2021-29102.
How can I fix CVE-2021-29102?
To fix CVE-2021-29102, users should install the ArcGIS Server Security 2021 Update 1 patch provided by Esri. More information can be found at the provided reference link.