CVE-2024-51961: Local file inclusion (LFI) vulnerability in ArcGIS Server
Vulnerability summary
CVE-2024-51961 is a high (CVSS 7.5) External Control of File Name or Path vulnerability in esri arcgis server. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 40.3% of scored vulnerabilities.
Timeline
- 03-03-2025PublishedVulnerability first disclosed.
- 10-04-2025Last modifiedVulnerability information updated.
Description
There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server. Due to the nature of the files accessible in this vulnerability the impact to confidentiality is High there is no impact to both integrity or availability.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.47% on 26-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
- CWE-610Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Affected systems
Esri1 product
- arcgis server≥ all, ≤ 11.3 | ≥ 10.9.1, ≤ 11.3
1 vendor · 1 product
References
1 links- www.esri.com/arcgis-blog/…Vendor Advisory