1. Home
  2. CVE Database
  3. CVE-2024-51961
HIGH · 7.5

CVE-2024-51961

There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration i...

Vulnerability Description

There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server.  Due to the nature of the files accessible in this vulnerability the impact to confidentiality is High there is no impact to both integrity or availability.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
EsriArcgis Server>= 10.9.1, <= 11.3

Related Weaknesses (CWE)

CWE-73CWE-610

References

FAQ

What is CVE-2024-51961?

CVE-2024-51961 is a vulnerability with a CVSS score of 7.5 (HIGH). There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration i...

How severe is CVE-2024-51961?

CVE-2024-51961 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-51961?

Check the references section above for vendor advisories and patch information. Affected products include: Esri Arcgis Server.