CVE-2024-37349: fallo de gravedad media en Absolute Software Secure Access
Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.5epss 0.3%
There is a cross-site scripting vulnerability in the
management UI of Absolute Secure Access prior to version 13.06. Attackers with
system administrator permissions can interfere with other system
administrator’s use of the management UI when the victim administrator edits
the same management object. This vulnerability is distinct from CVE-2024-37348 and
CVE-2024-37351. The scope is unchanged, there is no loss of confidentiality. Impact
to system integrity is high, impact to system availability is none.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Productos afectados
Absolute Software · Secure AccessCVEs relacionadas — Absolute Software Secure Access
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-37346MEDIUMInsufficient input validation vulnerability in the Absolute Secure Access Warehouse prior to 13.06EPSS 0.4%CVE-2024-40875MEDIUMCross-site scripting vulnerability in the Secure Access administrative console prior to 13.52EPSS 0.3%CVE-2026-116768HIGHMissing length validation in Absolute Secure AccessEPSS 0.3%CVE-2026-33446LOWBuffer overflow in client authentication prior to version 14.50EPSS 0.3%CVE-2024-37350MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%CVE-2024-37352MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%