CVE-2024-51959

CVSS 3.1 Score 4.8 of 10 (medium)

Attack Complexity low
Scope changed
Privileges Required high
Confidentiality low
Integrity low
Availability none

Details

Published Mar 3, 2025
Updated: Mar 6, 2025
CWE ID 79

Summary

CVE-2024-51959 is a stored Cross-site Scripting (XSS) vulnerability affecting ArcGIS Server versions 10.9.1 to 11.3. This issue grants a remote, authenticated attacker the ability to create maliciously crafted links, which, when clicked, can inject and execute arbitrary JavaScript code in the victim's browser. The attacker needs publisher capabilities to exploit the vulnerability, and the impact on confidentiality and integrity is considered low. Availability remains unaffected.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share