Log in Start free

Vulnerability · Published Mar 3, 2025 · Assigned by Esri

CVE-2024-51962SQL injection vulnerability in ArcGIS Server

High 8.7

In plain English

A high-severity SQL injection in ArcGIS Server from Esri. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High
Exploit odds (30 days)0.5%top 56.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed by a remote authenticated user requiring elevated, non‑administrative privileges. Exploitation is restricted to users with advanced application‑specific permissions, indicating high privileges are required. Successful exploitation would have a high impact on integrity and confidentiality, with no impact on availability.

Affected products (as reported)

VendorProductVersions
Esri ArcGIS Server all – through 11.3

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

References