CVE-2024-5888

Stored XSS in Rest Services API for a Toolbox published as GP Service

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51966

Directory traversal vulnerability in ArcGIS Server

There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory. There is no impact to integrity or availability due to the nature of the files that can be accessed, but there is a potential high impact to confidentiality.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51963

Stored XSS in ArcGIS Server Manager

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and follow that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51961

Local file inclusion (LFI) vulnerability in ArcGIS Server

There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server.  Due to the nature of the files accessible in this vulnerability the impact to confidentiality is High there is no impact to both integrity or availability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51960

Stored XSS in ArcGIS Server Administrator Directory

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51959

Stored XSS issue in Server Admin API

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51958

Directory traversal vulnerability in the admin api for service thumbnails

There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory.  There is no impact to integrity or availability due to the nature of the files that can be accessed, but there is a potential high impact to confidentiality.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51957

Stored XSS vulnerability in ArcGIS Rest Services Directory

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51956

Stored XSS vulnerability in ArcGIS Server Administrator Directory

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51953

Stored XSS in ArcGIS Server Rest services

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51952

Stored XSS issue in ArcGIS Server

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51951

Stored XSS in Server Admin API

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51950

Stored XSS in Server Admin under Services > lifecycleinfos

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51949

Stored XSS vulnerability in Rest Services under OGCFeature Service and Map Service

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51948

Stored XSS vulnerability in Rest Services under Job ID

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51947

Stored XSS vulnerability in Rest Services under Layer name

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51946

Stored XSS in Rest Services Directory under Identify operation

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51945

Stored XSS issues in Server Admin API

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51944

Stored XSS in Rest Services Directory

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server

CVE-2024-51942

Stored XSS vulnerability in Rest Admin API under Hosted Feature Services page

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Esri

Products

Arcgis Server