Lucene search

AbsoluteCVE-2024-37345

HistoryJun 20, 2024 - 5:15 p.m.

CVE-2024-37345

2024-06-2017:15:51

CWE-79

Absolute

web.nvd.nist.gov

cross-site scripting

absolute secure access

administrative ui

vulnerability

system integrity

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

17.6%

JSON

There is a cross-site scripting vulnerability in the Secure
Access administrative UI of Absolute Secure Access prior to version 13.06.
Attackers can pass a limited-length script to the administrative UI which is
then stored where an administrator can access it. The scope is unchanged, there
is no loss of confidentiality. Impact to system availability is none, impact to
system integrity is high

Affected configurations

Nvd

Node

absolutesecure_accessRange<13.06

VendorProductVersionCPE
absolutesecure_access*cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
absolute	secure_access	*	cpe:2.3:a:absolute:secure_access::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Secure Access",
    "vendor": "Absolute Software",
    "versions": [
      {
        "lessThan": "13.06",
        "status": "affected",
        "version": "0",
        "versionType": "Server"
      }
    ]
  }
]

References

www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37345/

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

17.6%

JSON

Related for CVE-2024-37345