Stored Cross-Site Scripting Vulnerability in ArcGIS Server by Esri

CVE-2024-51945

What is CVE-2024-51945?

A stored Cross-Site Scripting vulnerability exists in ArcGIS Server versions 10.9.1 to 11.3, enabling remote, authenticated attackers to craft a link that, when clicked by an unsuspecting user, may execute arbitrary JavaScript code in their browser. This attack necessitates high-level privileges typically granted to publishers. While the risk to confidentiality and integrity is minimal, it remains essential for organizations using affected versions to implement appropriate security measures to mitigate potential exploits.

References