1. Home
  2. CVE Database
  3. CVE-2024-51954
HIGH · 8.5

CVE-2024-51954

There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker t...

Vulnerability Description

There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker to access secure services published to a standalone (unfederated) ArcGIS Server instance. Successful exploitation results in unauthorized access to protected services outside the attacker’s originally assigned authorization boundary, constituting a scope change. If exploited, this issue would have a high impact on confidentiality, a low impact on integrity, and no impact on the availability of the software.

CVSS Score

8.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
EsriArcgis Server>= 10.9.1, <= 11.3
LinuxLinux Kernel-
MicrosoftWindows-

Related Weaknesses (CWE)

CWE-284

References

FAQ

What is CVE-2024-51954?

CVE-2024-51954 is a vulnerability with a CVSS score of 8.5 (HIGH). There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker t...

How severe is CVE-2024-51954?

CVE-2024-51954 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-51954?

Check the references section above for vendor advisories and patch information. Affected products include: Esri Arcgis Server, Linux Linux Kernel, Microsoft Windows.