« Volver al listado

CVE-2013-5221

Estado: ModificadaBaja (3.5)—

The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging (1) publisher or (2) administrator privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Esri — Arcgis Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-5221",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-09-24T10:35:52.017",
  "references": [
    {
      "url": "http://support.esri.com/en/downloads/patches-servicepacks/view/productid/66/metaid/2009",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://support.esri.com/en/knowledgebase/techarticles/detail/41497",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://support.esri.com/en/downloads/patches-servicepacks/view/productid/66/metaid/2009",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.esri.com/en/knowledgebase/techarticles/detail/41497",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging (1) publisher or (2) administrator privileges."
    },
    {
      "lang": "es",
      "value": "La funcionalidad \"mobile-upload\" en Esri ArcGIS para Server v10.1 hasta v10.2 permite a los usuarios autenticados remotamente subir ficheros .exe aprovechando privilegios de editor o administrador."
    }
  ],
  "lastModified": "2026-06-16T23:58:31.997",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:esri:arcgis_server:10.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9177A95B-4A0A-42D7-9792-E58CC2207021"
            },
            {
              "criteria": "cpe:2.3:a:esri:arcgis_server:10.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E93A0EA7-1DCB-465F-A34B-44CC8294EE67"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}