CVE-2024-51963

CVSS 3.1 Score 4.8 of 10 (medium)

Attack Complexity low
Scope changed
Privileges Required high
Confidentiality low
Integrity low
Availability none

Details

Published Mar 3, 2025
Updated: Mar 6, 2025
CWE ID 79

Summary

CVE-2024-51963 is a stored Cross-site Scripting (XSS) vulnerability affecting ArcGIS Server versions 10.9.1 to 11.3. An authenticated attacker with high privileges (publisher capabilities) can exploit this issue by creating a malicious link. When a user clicks on this link, they may unwittingly execute arbitrary JavaScript code in their browser, leading to potential information disclosure or unintended actions. The impact on confidentiality and integrity is low, but the vulnerability has no effect on system availability.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share