Vulnerability Description
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Esri | Arcgis Server | >= 10.9.1, <= 11.3 |
Related Weaknesses (CWE)
References
FAQ
What is CVE-2024-51952?
CVE-2024-51952 is a vulnerability with a CVSS score of 4.8 (MEDIUM). There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked cou...
How severe is CVE-2024-51952?
CVE-2024-51952 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-51952?
Check the references section above for vendor advisories and patch information. Affected products include: Esri Arcgis Server.