CVE-2021-29101

ArcGIS GeoEvent Server has a Directory Traversal security vulnerability.

State: Published
Severity: 8.6 High
Published: May 5, 2021
Updated: Apr 10, 2025
Reserved: Mar 23, 2021

Description

ArcGIS GeoEvent Server versions 10.8.1 and below has a read-only directory path traversal vulnerability that could allow an unauthenticated, remote attacker to perform directory traversal attacks and read arbitrary files on the system.

Scores

CVSS	Score	Vector	Source
3.0	8.6 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	Esri

Weaknesses

CWE-23 Relative Path Traversal

Affected Products

Product	Versions
ArcGIS GeoEvent ServerEsri	All through 10.8.1Affected

References

https://www.esri.com/arcgis-blog/products/ext-server-geoevent/administration/arcgis-geoevent-server-security-update-2021-patch-1

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.