Stored Cross-site Scripting Vulnerability in ArcGIS Server by Esri

CVE-2024-51960

What is CVE-2024-51960?

A stored Cross-site Scripting vulnerability exists in ArcGIS Server versions 10.9.1 to 11.3. This flaw allows a remote authenticated attacker to craft a malicious link capable of executing arbitrary JavaScript code in the browser of a victim who clicks the link. The attack requires elevated privileges, specifically publisher capabilities, to be executed successfully. While the potential impact on confidentiality and integrity is limited, it poses a risk to user data and interactions within the application. It's crucial for organizations using these versions to apply security patches to safeguard against such vulnerabilities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References