CVE-2021-29113: Remote file inclusion vulnerability in ArcGIS Server help documentation
Modified
Published 07-12-2021Last modified 10-04-2025
Vulnerability summary
CVE-2021-29113 is a medium (CVSS 4.7) PHP Remote File Inclusion vulnerability in esri arcgis server. EPSS estimates a 0.84% chance of exploitation in the next 30 days, higher than 57.6% of scored vulnerabilities.
CVSS score
4.7/10
010
Medium · v3.0 (CVE.org)EPSS score
0.84%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Timeline
- 07-12-2021PublishedVulnerability first disclosed.
- 10-04-2025Last modifiedVulnerability information updated.
Description
A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page.
CVSS metrics
4 scores · 2 sources · 3 versionsMedium 4.7Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:NSourcesSingle source
Medium 4.7Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:NSourcesAll 2 agree
- NVDNIST4.7MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
0.84%
Chance of exploitation in the next 30 days
Percentile
58%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 0.81% on 26-09-2026
26-09-202626-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
- CWE-829Inclusion of Functionality from Untrusted Control SphereThe product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
Affected systems
Esri1 product
- arcgis server≥ 10.9, ≤ 10.9.0 | ≤ 10.9.0
1 vendor · 1 product