CVE-2024-51962

HighCVSS 8.7/10Last modified Jun 17, 2026

Description

A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed by a remote authenticated user requiring elevated, non‑administrative privileges. Exploitation is restricted to users with advanced application‑specific permissions, indicating high privileges are required. Successful exploitation would have a high impact on integrity and confidentiality, with no impact on availability.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
EsriArcGIS Server>= all, <= 11.3

References

Timeline

Published
Mar 3, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-519634.8There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and follow that may allow a remote, authenticated atCVE-2024-519664.9There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticCVE-2024-51979.1There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align CVE-2024-519775.3An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP CVE-2024-519789.8An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An CVE-2024-519797.2An authenticated attacker may trigger a stack based buffer overflow by performing a malformed request to either the HTTP service (TCP port 8CVE-2024-51983.3OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driveCVE-2024-519805.3An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open a TCP connection to CVE-2024-519815.3An unauthenticated attacker may perform a blind server side request forgery (SSRF), due to a CLRF injection issue that can be leveraged to pCVE-2024-519827.5An unauthenticated attacker who can connect to TCP port 9100 can issue a Printer Job Language (PJL) command that will crash the target devicCVE-2024-519837.5An unauthenticated attacker who can connect to the Web Services feature (HTTP TCP port 80) can issue a WS-Scan SOAP request containing an unCVE-2024-519846.8An authenticated attacker can reconfigure the target device to use an external service (such as LDAP or FTP) controlled by the attacker. If
CVE-2024-51962: High severity, CVSS 8.7 | Vulnix