CVE-2024-51942: Stored XSS vulnerability in Rest Admin API under Hosted Feature Services page
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 10.9.1 – 11.3 that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
Other sources
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51942?
CVE-2024-51942 is classified as a medium severity vulnerability due to the potential for stored Cross-site Scripting attacks.
How do I fix CVE-2024-51942?
To fix CVE-2024-51942, it is recommended to apply the latest security patches provided by Esri for ArcGIS Server versions 10.9.1 through 11.3.
Who is affected by CVE-2024-51942?
CVE-2024-51942 affects users of Esri ArcGIS Server versions 10.9.1 to 11.3.
What type of vulnerability is CVE-2024-51942?
CVE-2024-51942 is a stored Cross-site Scripting vulnerability that can allow remote authenticated attackers to execute arbitrary JavaScript code.
Can CVE-2024-51942 be exploited without user interaction?
CVE-2024-51942 requires user interaction, as an authenticated attacker must provide a crafted link that the victim must click to exploit the vulnerability.