Unrated severityNVD Advisory· Published Apr 8, 2021· Updated Aug 3, 2024

CVE-2021-3012

Description

A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as onerror (in the URL field of the Parameters tab).

Affected products

ESRI/Enterprisedescription
Esri/ArcGIS Enterprisellm-fuzzy
Range: <10.9

Patches

Vulnerability mechanics

References

blog.bssi.fr/cve-2021-3012-vulnerability-allowing-remote-html-javascript-code-injection-on-esri-arcgis-products/mitrex_refsource_MISC

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000