Stored Cross-site Scripting Vulnerability in ArcGIS Server by Esri

CVE-2024-51947

What is CVE-2024-51947?

A stored Cross-site Scripting vulnerability exists in ArcGIS Server, affecting versions 10.9.1 through 11.3. This vulnerability allows a remote, authenticated attacker with publisher capabilities to craft a malicious link. When this link is accessed, it can execute arbitrary JavaScript code within the victim's browser. While the attack's impact on confidentiality and integrity is limited, it poses a significant risk to users' security. Organizations using affected versions are encouraged to apply security patches to mitigate the risks associated with this vulnerability.

References