CVE-2024-37350

There is a cross-site scripting vulnerability in the policy management UI of Absolute Secure Access prior to version 13.06. Attackers can interfere with a system administrator’s use of the policy management UI when the attacker convinces the victim administrator to follow a crafted link to the vulnerable component while the attacking administrator is authenticated to the console. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37350/	Vendor Advisory
https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37350/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-06-20 18:15

Updated : 2024-11-21 09:23

NVD link : CVE-2024-37350

Mitre link : CVE-2024-37350

CVE.ORG link : CVE-2024-37350

JSON object : View

Products Affected

absolute

secure_access

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-37350", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "SecurityResponse@netmotionsoftware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-06-20T18:15:12.103", "references": [{"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37350/", "tags": ["Vendor Advisory"], "source": "SecurityResponse@netmotionsoftware.com"}, {"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37350/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "SecurityResponse@netmotionsoftware.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "There is a cross-site scripting vulnerability in the policy\nmanagement UI of Absolute Secure Access prior to version 13.06. Attackers can\ninterfere with a system administrator\u2019s use of the policy management UI when\nthe attacker convinces the victim administrator to follow a crafted link to the\nvulnerable component while the attacking administrator is authenticated to the\nconsole. The scope is unchanged, there is no loss of confidentiality. Impact to\nsystem integrity is high, impact to system availability is none."}, {"lang": "es", "value": "Existe una vulnerabilidad de Cross Site Scripting en la interfaz de usuario de administraci\u00f3n de pol\u00edticas de Absolute Secure Access antes de la versi\u00f3n 13.06. Los atacantes pueden interferir con el uso de la interfaz de usuario de administraci\u00f3n de pol\u00edticas por parte de un administrador del sistema cuando el atacante convence al administrador de la v\u00edctima de seguir un enlace manipulado al componente vulnerable mientras el administrador atacante est\u00e1 autenticado en la consola. El alcance no cambia, no hay p\u00e9rdida de confidencialidad. El impacto en la integridad del sistema es alto, el impacto en la disponibilidad del sistema es nulo."}], "lastModified": "2024-11-21T09:23:42.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1113DB3C-BD71-42ED-A4AF-0098AA744FD8", "versionEndExcluding": "13.06"}], "operator": "OR"}]}], "sourceIdentifier": "SecurityResponse@netmotionsoftware.com"}