CVE-2024-51953: Stored XSS in ArcGIS Server Rest services
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 10.9.1 – 11.3 that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
Other sources
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51953?
CVE-2024-51953 is considered a high severity vulnerability due to its potential for stored Cross-site Scripting attacks.
How do I fix CVE-2024-51953?
To fix CVE-2024-51953, upgrade ArcGIS Server to version 11.4 or later, where the vulnerability has been addressed.
Who is affected by CVE-2024-51953?
CVE-2024-51953 affects users of Esri ArcGIS Server versions 10.9.1 to 11.3.
What type of vulnerability is CVE-2024-51953?
CVE-2024-51953 is a stored Cross-site Scripting (XSS) vulnerability.
What can attackers exploit with CVE-2024-51953?
Attackers can exploit CVE-2024-51953 to execute arbitrary JavaScript code in the victim's browser through a crafted link.