Stored Cross-site Scripting Vulnerability in ArcGIS Server by Esri

CVE-2024-51960

What is CVE-2024-51960?

A stored Cross-site Scripting vulnerability exists in ArcGIS Server versions 10.9.1 to 11.3. This flaw allows a remote authenticated attacker to craft a malicious link capable of executing arbitrary JavaScript code in the browser of a victim who clicks the link. The attack requires elevated privileges, specifically publisher capabilities, to be executed successfully. While the potential impact on confidentiality and integrity is limited, it poses a risk to user data and interactions within the application. It's crucial for organizations using these versions to apply security patches to safeguard against such vulnerabilities.

References