XSS in Esri Arcgis Server
CVE-2024-51945
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (15.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Esri Arcgis Server — versions all
- Esri Arcgis_server
Weakness classification (CWE)
References
- psirt@esri.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-51945?
- CVE-2024-51945 is a medium-severity vulnerability in Esri Arcgis Server, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2025-03-03.
- How severe is CVE-2024-51945?
- Medium severity. CVSS v3 base score is 4.8 out of 10.