CVE-2021-29108— There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below.

There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below.

There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account (XML Signature Wrapping Attack). In addition patching, Esri also strongly recommends as best practice for SAML assertions to be signed and encrypted.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

密码学签名的验证不恰当

Esri Portal For ArcGIS 数据伪造问题漏洞

Esri Portal For ArcGIS是美国环境系统研究所（Esri）公司的一种允许在组织内与其他人共享地图、场景、应用程序和其他地理信息的组件。 Esri Portal For ArcGIS 10.9 及之前版本存在数据伪造问题漏洞，该漏洞可允许远程的、经过身份验证的攻击者利用该漏洞冒充另一个帐户。

N/A

N/A