CVE-2024-51961: Local file inclusion (LFI) vulnerability in ArcGIS Server
There is a local file inclusion vulnerability in ArcGIS Server 10.9.1 thru 11.3 that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server. Due to the nature of the files accessible in this vulnerability the impact to confidentiality is High there is no impact to both integrity or availability.
Other sources
There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server. Due to the nature of the files accessible in this vulnerability the impact to confidentiality is High there is no impact to both integrity or availability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-51961?
CVE-2024-51961 has been classified as a high-severity vulnerability due to the potential exposure of sensitive configuration information.
How do I fix CVE-2024-51961?
To fix CVE-2024-51961, users should apply the most recent security patches provided by Esri for ArcGIS Server versions 10.9.1 through 11.3.
Who is affected by CVE-2024-51961?
CVE-2024-51961 affects users of Esri ArcGIS Server versions 10.9.1 through 11.3.
Can CVE-2024-51961 be exploited remotely?
Yes, CVE-2024-51961 can be exploited by a remote, unauthenticated attacker.
What type of vulnerability is CVE-2024-51961?
CVE-2024-51961 is classified as a local file inclusion (LFI) vulnerability.