Stored Cross-site Scripting Vulnerability in ArcGIS Server by Esri

CVE-2024-51952

What is CVE-2024-51952?

A stored Cross-site Scripting vulnerability has been identified in ArcGIS Server versions 10.9.1 through 11.3. This flaw enables a remote, authenticated attacker to craft a malicious link that, when accessed by a victim, can execute arbitrary JavaScript code in their browser. The attacker's privileges for carrying out this exploit require a high level of access, specifically publisher capabilities. While the attack may compromise confidentiality and integrity of user interactions, it lacks an impact on system availability. Organizations using affected versions should assess their exposure and apply security patches as needed to mitigate risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References