CVE-2021-29094: 
ArcGIS Server vulnerability analysis and mitigation

Multiple buffer overflow vulnerabilities were discovered in Esri ArcGIS Server 10.8.1 and earlier versions. The vulnerability, identified as CVE-2021-29094, was disclosed on March 25, 2021, and affects the file parsing functionality of the software. This security flaw allows authenticated attackers with specialized permissions to achieve arbitrary code execution in the context of the service account (NIST NVD).

The vulnerability is classified as CWE-120 (Buffer Copy without Checking Size of Input - Classic Buffer Overflow). It received a CVSS v3.1 base score of 6.8 (Medium) from NIST NVD with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H. The vendor's assessment assigned a slightly lower CVSS score of 6.4 (Medium) with the vector string CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H (Esri Advisory).

The vulnerability can lead to arbitrary code execution in the context of the service account when successfully exploited. The impact metrics indicate potential high severity consequences for confidentiality, integrity, and availability of the affected system (NIST NVD).

The vulnerability requires an authenticated attacker with specialized permissions and user interaction to exploit. The attack complexity was initially assessed as High by the vendor but later revised to Low by NIST, indicating varying assessments of the exploitation difficulty (NIST NVD).

Esri has released official updates for ArcGIS Server to address this vulnerability. The fix has been confirmed by the vendor and received an Official Fix status in the remediation level assessment (Esri Advisory).