CVE-2024-51948: Stored XSS vulnerability in Rest Services under Job ID
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 10.9.1 – 11.3 that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
Other sources
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51948?
CVE-2024-51948 is categorized as a high severity vulnerability due to the potential for remote code execution via stored Cross-site Scripting.
How do I fix CVE-2024-51948?
To mitigate CVE-2024-51948, update ArcGIS Server to the latest version past 11.3, where the vulnerability has been addressed.
What versions of ArcGIS Server are affected by CVE-2024-51948?
CVE-2024-51948 affects Esri ArcGIS Server versions 10.9.1 through 11.3.
Who can exploit the vulnerability identified in CVE-2024-51948?
A remote, authenticated attacker can exploit CVE-2024-51948 by creating a crafted link that executes JavaScript code in the victim's browser.
What type of vulnerability is CVE-2024-51948?
CVE-2024-51948 is a stored Cross-site Scripting (XSS) vulnerability.