CVE-2024-51946: Stored XSS in Rest Services Directory under Identify operation
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 10.9.1 – 11.3 that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
Other sources
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51946?
CVE-2024-51946 is categorized as a medium-severity vulnerability due to its potential to allow remote, authenticated attackers to execute arbitrary JavaScript code.
How do I fix CVE-2024-51946?
To fix CVE-2024-51946, update your ArcGIS Server to the latest version available, which is beyond version 11.3.
Who is affected by CVE-2024-51946?
CVE-2024-51946 affects users of Esri ArcGIS Server versions 10.9.1 through 11.3.
What type of attack is CVE-2024-51946 associated with?
CVE-2024-51946 is associated with stored Cross-site Scripting (XSS) attacks that can lead to unauthorized JavaScript execution.
Can CVE-2024-51946 be exploited without authentication?
No, exploitation of CVE-2024-51946 requires authentication, as it is a stored XSS vulnerability targeting authenticated users.