CVE-2024-51958 - CVE House
Back to Database
Status published Medium CVE-2024-51958

Directory traversal vulnerability in the admin api for service thumbnails

Vulnerability Description

There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory.  There is no impact to integrity or availability due to the nature of the files that can be accessed, but there is a potential high impact to confidentiality.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-51958

Credits & Attribution

No credits recorded in the NVD database.

References

More from Esri

View All →
CVE-2025-67712
HTML injection issue in ArcGIS Web App Builder
Medium 4.7
CVE-2025-67711
Reflected XSS vulnerability in ArcGIS Server.
Medium 6.1
CVE-2025-67710
Stored XSS vulnerability in ArcGIS Server
Medium 6.1
CVE-2025-67709
There is a cross site scripting issue in ArcGIS Server.
Medium 6.1
CVE-2025-67708
Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server.
Medium 6.1

Affected Vendor

Affected Software

ArcGIS Server
Vulnerable Versions:
all

Timeline

Official Publish: March 3rd, 2025
Last Modified: April 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact