CVE-2024-37350: medium-severity vulnerability in Absolute Software Secure Access
Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.3%
There is a cross-site scripting vulnerability in the policy
management UI of Absolute Secure Access prior to version 13.06. Attackers can
interfere with a system administrator’s use of the policy management UI when
the attacker convinces the victim administrator to follow a crafted link to the
vulnerable component while the attacking administrator is authenticated to the
console. The scope is unchanged, there is no loss of confidentiality. Impact to
system integrity is high, impact to system availability is none.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected products
Absolute Software · Secure AccessRelated CVEs — Absolute Software Secure Access
In the same product, most dangerous first.
CVE-2024-37346MEDIUMInsufficient input validation vulnerability in the Absolute Secure Access Warehouse prior to 13.06EPSS 0.4%CVE-2024-40875MEDIUMCross-site scripting vulnerability in the Secure Access administrative console prior to 13.52EPSS 0.3%CVE-2026-116768HIGHMissing length validation in Absolute Secure AccessEPSS 0.3%CVE-2026-33446LOWBuffer overflow in client authentication prior to version 14.50EPSS 0.3%CVE-2024-37352MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%CVE-2024-37351MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%