CVE-2024-51960: Stored XSS in ArcGIS Server Administrator Directory
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 10.9.1 – 11.3 that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
Other sources
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51960?
CVE-2024-51960 is classified as a medium severity vulnerability due to its potential impact on user sessions and application integrity.
How do I fix CVE-2024-51960?
To remediate CVE-2024-51960, update your ESRI ArcGIS Server to the latest available version beyond 11.3.
Who is vulnerable to CVE-2024-51960?
Any remote, authenticated user of ESRI ArcGIS Server versions 10.9.1 to 11.3 may exploit CVE-2024-51960.
What type of attack does CVE-2024-51960 enable?
CVE-2024-51960 enables a stored Cross-site Scripting attack that could allow arbitrary JavaScript execution in a victim's browser.
What versions of ArcGIS Server are affected by CVE-2024-51960?
CVE-2024-51960 affects ESRI ArcGIS Server versions from 10.9.1 through 11.3.