Cross-Site Scripting Flaw in Absolute Secure Access Management UI
CVE-2024-37352

3.4LOW

Key Information:

Vendor

Absolute

Status
Secure Access
Vendor
CVE Published:
20 June 2024

What is CVE-2024-37352?

A cross-site scripting vulnerability exists in the management UI of Absolute Secure Access versions earlier than 13.06. This flaw enables system administrators with elevated permissions to manipulate the interface, potentially affecting the experience of other administrators accessing the same management page. While there is no loss of confidentiality or availability, the integrity of the system could be compromised under certain conditions. Administrators are urged to update to the latest version to mitigate this risk.

References

https://www.absolute.com/platform/security-information/vu...

CVSS V3.1

Score:
3.4
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.