What is CVE-2021-29093?

CVE-2021-29093 is a medium-severity vulnerability in Esri Arcgis Server, classified under Use After Free. CVSS score: 6.8/10. Published 2021-03-25.

How severe is CVE-2021-29093?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Use After Free in Esri Arcgis Server

CVE-2021-29093

A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code execution in the context of the service account.

Vulnerability class: Use-After-Free

EPSS: 0.009 (58.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H.

Affected products

Esri Arcgis Server — versions All
Esri Arcgis_server

Weakness classification (CWE)

CWE-416 — Use After Free

References

psirt@esri.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2021-29093?: CVE-2021-29093 is a medium-severity vulnerability in Esri Arcgis Server, classified under Use After Free. CVSS score: 6.8/10. Published 2021-03-25.
How severe is CVE-2021-29093?: Medium severity. CVSS v3 base score is 6.8 out of 10.