Stored Cross-site Scripting Vulnerability in ArcGIS Server by Esri

CVE-2024-51959

What is CVE-2024-51959?

A stored Cross-site Scripting (XSS) vulnerability exists in ArcGIS Server versions 10.9.1 through 11.3. This vulnerability permits a remote, authenticated attacker to craft a stored malicious link, which when accessed, could execute arbitrary JavaScript code in the victim’s web browser. The attack requires high-level privileges, specifically publisher capabilities, to be executed. Although the potential impact on confidentiality and integrity is considered low, this vulnerability poses a significant risk for web application security within affected environments.

References