CVE-2021-29102
CRITICALArcGIS Server < 10.9.0 - Unauthenticated Server-Side Request Forgery
Title source: llmDescription
A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch/
Scores
CVSS v3
9.1
EPSS
0.0066
EPSS Percentile
71.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-918
Status
published
Products (1)
esri/arcgis_server
< 10.9.0
Published
Jul 11, 2021
Tracked Since
Feb 18, 2026