Cross-Site Scripting Flaw in Policy Management UI of Absolute Secure Access
CVE-2024-37344

3.4LOW

Key Information:

Vendor

Absolute

Status
Secure Access
Vendor
CVE Published:
20 June 2024

What is CVE-2024-37344?

A cross-site scripting vulnerability exists in the Policy Management UI of Absolute Secure Access for versions prior to 13.06. This flaw allows attackers with system administrator permissions to disrupt the activities of other administrators when both are concurrently editing the same policy object. While the vulnerability does not affect the confidentiality of data or system availability, it poses a significant risk to system integrity, as it potentially enables malicious manipulation during policy management processes.

References

https://www.absolute.com/platform/security-information/vu...

CVSS V3.1

Score:
3.4
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.