CVE-2024-51962CWE-89

SQL injection vulnerability in ArcGIS Server

High · published March 3, 2025

CVSS v3.1
8.7
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed by a remote authenticated user requiring elevated, non‑administrative privileges. Exploitation is restricted to users with advanced application‑specific permissions, indicating high privileges are required. Successful exploitation would have a high impact on integrity and confidentiality, with no impact on availability.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00506 · 42.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-03-03T19:58Z
EPSS history
Timeline
  • 03 MAR 19:58Z
    SQL injection vulnerability in ArcGIS Server
    cvelistv5