CVE-2024-37348

Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06

State: Published
Severity: 4.5 Medium
Published: Jun 20, 2024
Updated: Aug 2, 2024
Reserved: Jun 5, 2024

Description

There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with another system administrator’s use of the management UI when the second administrator later edits the same management object. This vulnerability is distinct from CVE-2024-37349 and CVE-2024-37351. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none.

Scores

CVSS	Score	Vector	Source
3.1	4.5 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N	Absolute

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Affected Products

Product	Versions
Secure AccessAbsolute Software	before 13.06Affected

References

https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37348/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.