CVE-2024-37345

There is a cross-site scripting vulnerability in the Secure Access administrative UI of Absolute Secure Access prior to version 13.06. Attackers can pass a limited-length script to the administrative UI which is then stored where an administrator can access it. The scope is unchanged, there is no loss of confidentiality. Impact to system availability is none, impact to system integrity is high

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37345/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*

History

06 Aug 2024, 13:49

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~5.3~~	v2 : unknown v3 : 5.4
CPE		cpe:2.3:a:absolute:secure_access::::::::
References	~~() https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37345/ -~~	() https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37345/ - Vendor Advisory
Summary		(es) Existe una vulnerabilidad de Cross Site Scripting en la interfaz de usuario administrativa de Secure Access de Absolute Secure Access antes de la versión 13.06. Los atacantes pueden pasar un script de longitud limitada a la interfaz de usuario administrativa que luego se almacena donde un administrador puede acceder a él. El alcance no cambia, no hay pérdida de confidencialidad. El impacto en la disponibilidad del sistema es nulo, el impacto en la integridad del sistema es alto
First Time		Absolute Absolute secure Access

20 Jun 2024, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-06-20 17:15

Updated : 2024-08-06 13:49

NVD link : CVE-2024-37345

Mitre link : CVE-2024-37345

CVE.ORG link : CVE-2024-37345

JSON object : View

Products Affected

absolute

secure_access

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-37345", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "SecurityResponse@netmotionsoftware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "published": "2024-06-20T17:15:51.397", "references": [{"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37345/", "tags": ["Vendor Advisory"], "source": "SecurityResponse@netmotionsoftware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "SecurityResponse@netmotionsoftware.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "There is a cross-site scripting vulnerability in the Secure\nAccess administrative UI of Absolute Secure Access prior to version 13.06.\nAttackers can pass a limited-length script to the administrative UI which is\nthen stored where an administrator can access it. The scope is unchanged, there\nis no loss of confidentiality. Impact to system availability is none, impact to\nsystem integrity is high"}, {"lang": "es", "value": "Existe una vulnerabilidad de Cross Site Scripting en la interfaz de usuario administrativa de Secure Access de Absolute Secure Access antes de la versi\u00f3n 13.06. Los atacantes pueden pasar un script de longitud limitada a la interfaz de usuario administrativa que luego se almacena donde un administrador puede acceder a \u00e9l. El alcance no cambia, no hay p\u00e9rdida de confidencialidad. El impacto en la disponibilidad del sistema es nulo, el impacto en la integridad del sistema es alto"}], "lastModified": "2024-08-06T13:49:26.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1113DB3C-BD71-42ED-A4AF-0098AA744FD8", "versionEndExcluding": "13.06"}], "operator": "OR"}]}], "sourceIdentifier": "SecurityResponse@netmotionsoftware.com"}