Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2021-29108

There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Esri

Description

There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account (XML Signature Wrapping Attack). In addition patching, Esri also strongly recommends as best practice for SAML assertions to be signed and encrypted.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Esri Portal for ArcGIS

Default version status: unaffected

  • 10.9.0 to < <10.9.0affected

References