CVE-2021-3012

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-04-08 · updated 2026-06-17
Weakness: CWE-79

Description

A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as onerror (in the URL field of the Parameters tab).

Affected products

Esri Arcgis Enterprise: before 10.9 — fixed in 10.9

How to fix

Upgrade to a fixed version: Esri Arcgis Enterprise 10.9. Check the vendor advisory for mitigations.

References

https://blog.bssi.fr/cve-2021-3012-vulnerability-allowing-remote-html-javascript-code-injection-on-esri-arcgis-products/
https://blog.bssi.fr/cve-2021-3012-vulnerability-allowing-remote-html-javascript-code-injection-on-esri-arcgis-products/

Get alerted when CVE-2021-3012 or the next vulnerability affects your stack