Lucene search

K
cvelistAbsoluteCVELIST:CVE-2024-37344
HistoryJun 20, 2024 - 4:38 p.m.

CVE-2024-37344 Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06

2024-06-2016:38:26
CWE-79
Absolute
www.cve.org
4
cross-site scripting
absolute secure access
administrative console
policy management ui
system administrator permissions
interference
policy object
confidentiality
system integrity

CVSS3

4.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

EPSS

0

Percentile

14.5%

There is a cross-site scripting vulnerability in the Policy
management UI of Absolute Secure Access prior to version 13.06. Attackers with
system administrator permissions can interfere with another system
administrator’s use of the policy management UI when the administrators are
editing the same policy object. The scope is unchanged, there is no loss of
confidentiality. Impact to system availability is none, impact to system
integrity is high.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Secure Access",
    "vendor": "Absolute Software",
    "versions": [
      {
        "lessThan": "13.06",
        "status": "affected",
        "version": "0",
        "versionType": "Server"
      }
    ]
  }
]

CVSS3

4.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

EPSS

0

Percentile

14.5%

Related for CVELIST:CVE-2024-37344