CVE-2024-37352: fallo de gravedad media en Absolute Software Secure Access
Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.5epss 0.3%
There is a cross-site scripting vulnerability in the
management UI of Absolute Secure Access prior to version 13.06 that allows
attackers with system administrator permissions to interfere with other system
administrators’ use of the management UI when the second administrator accesses
the vulnerable page. The scope is unchanged, there is no loss of
confidentiality. Impact to system integrity is high, impact to system
availability is none.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Productos afectados
Absolute Software · Secure AccessCVEs relacionadas — Absolute Software Secure Access
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-37346MEDIUMInsufficient input validation vulnerability in the Absolute Secure Access Warehouse prior to 13.06EPSS 0.4%CVE-2024-40875MEDIUMCross-site scripting vulnerability in the Secure Access administrative console prior to 13.52EPSS 0.3%CVE-2026-116768HIGHMissing length validation in Absolute Secure AccessEPSS 0.3%CVE-2026-33446LOWBuffer overflow in client authentication prior to version 14.50EPSS 0.3%CVE-2024-37350MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%CVE-2024-37351MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%