CVE-2021-29115: An information disclosure vulnerability
An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers. This issue may reveal field names, but not not disclose features.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this information disclosure vulnerability in ArcGIS Enterprise?
The vulnerability ID is CVE-2021-29115.
What is the severity level of CVE-2021-29115?
The severity level of CVE-2021-29115 is medium with a CVSS score of 5.3.
Which version of ArcGIS Enterprise is affected by CVE-2021-29115?
ArcGIS Enterprise versions 10.9.0 and below are affected by CVE-2021-29115.
What is the impact of the vulnerability CVE-2021-29115?
The vulnerability allows a remote attacker to view hidden field names in feature layers, revealing field names but not disclosing features.
How can I fix CVE-2021-29115?
To fix CVE-2021-29115, it is recommended to apply the ArcGIS Server Security 2021 Update 2 Patch, which is now available. Please refer to the Esri website for more details.