VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 7, 2021· Updated Apr 10, 2025

BUG-000142180 Hosted feature services vulnerable to stored XSS

CVE-2021-29116

Description

A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.

Affected products

2
  • Esri/Arcgis Serverllm-fuzzy2 versions
    10.8.1, 10.9+ 1 more
    • (no CPE)range: 10.8.1, 10.9
    • (no CPE)range: 10.8.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.