CVE-2024-51950: Stored XSS in Server Admin under Services > lifecycleinfos
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 10.9.1 – 11.3 that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
Other sources
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51950?
CVE-2024-51950 is classified as a stored Cross-site Scripting vulnerability with a high severity level.
How do I fix CVE-2024-51950?
To fix CVE-2024-51950, update ArcGIS Server to a patched version that addresses this vulnerability.
Who is affected by CVE-2024-51950?
CVE-2024-51950 affects users of ArcGIS Server versions 10.9.1 through 11.3.
What kind of attacks can CVE-2024-51950 facilitate?
CVE-2024-51950 can facilitate remote attacks that allow a malicious user to execute arbitrary JavaScript code in the victim’s browser.
Is user authentication required for CVE-2024-51950 exploitation?
Yes, CVE-2024-51950 requires the attacker to be an authenticated user to exploit the vulnerability.