CVE-2024-51947: Stored XSS vulnerability in Rest Services under Layer name
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 10.9.1 – 11.3 that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
Other sources
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51947?
CVE-2024-51947 is classified as a moderate severity vulnerability due to its potential to allow cross-site scripting in ArcGIS Server.
How do I fix CVE-2024-51947?
To mitigate CVE-2024-51947, upgrade to a patched version of ArcGIS Server that addresses this stored Cross-site Scripting vulnerability.
Who is affected by CVE-2024-51947?
CVE-2024-51947 affects ArcGIS Server versions 10.9.1 to 11.3, specifically impacting users with authenticated access.
What type of attack does CVE-2024-51947 facilitate?
CVE-2024-51947 facilitates stored Cross-site Scripting (XSS) attacks that can execute arbitrary JavaScript code in the victim's browser.
Is user authentication required for CVE-2024-51947 exploitation?
Yes, exploitation of CVE-2024-51947 requires the attacker to be authenticated in the ArcGIS Server environment.