CVE-2024-37347

There is a cross-site scripting vulnerability in the pool configuration component of the management UI of Absolute Secure Access prior to 13.06. Attackers with system administrator permissions can pass a limited length script to be run by another administrator. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none.

CVSS v3 3.4 LOW

3.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.7 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37347/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*

History

06 Aug 2024, 13:50

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de Cross Site Scripting en el componente de configuración del grupo de la interfaz de usuario de administración de Absolute Secure Access antes de la versión 13.06. Los atacantes con permisos de administrador del sistema pueden pasar un script de longitud limitada para que lo ejecute otro administrador. El alcance no cambia, no hay pérdida de confidencialidad. El impacto en la integridad del sistema es alto, el impacto en la disponibilidad del sistema es nulo.
CPE		cpe:2.3:a:absolute:secure_access::::::::
References	~~() https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37347/ -~~	() https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37347/ - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~4.5~~	v2 : unknown v3 : 3.4
First Time		Absolute Absolute secure Access

20 Jun 2024, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-06-20 17:15

Updated : 2024-08-06 13:50

NVD link : CVE-2024-37347

Mitre link : CVE-2024-37347

CVE.ORG link : CVE-2024-37347

JSON object : View

Products Affected

absolute

secure_access

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-37347", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.4, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.7}, {"type": "Secondary", "source": "SecurityResponse@netmotionsoftware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "published": "2024-06-20T17:15:51.853", "references": [{"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37347/", "tags": ["Vendor Advisory"], "source": "SecurityResponse@netmotionsoftware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "SecurityResponse@netmotionsoftware.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "There is a cross-site scripting vulnerability in the pool\nconfiguration component of the management UI of Absolute Secure Access prior to\n13.06. Attackers with system administrator permissions can pass a limited\nlength script to be run by another administrator. The scope is unchanged, there\nis no loss of confidentiality. Impact to system integrity is high, impact to\nsystem availability is none."}, {"lang": "es", "value": "Existe una vulnerabilidad de Cross Site Scripting en el componente de configuraci\u00f3n del grupo de la interfaz de usuario de administraci\u00f3n de Absolute Secure Access antes de la versi\u00f3n 13.06. Los atacantes con permisos de administrador del sistema pueden pasar un script de longitud limitada para que lo ejecute otro administrador. El alcance no cambia, no hay p\u00e9rdida de confidencialidad. El impacto en la integridad del sistema es alto, el impacto en la disponibilidad del sistema es nulo."}], "lastModified": "2024-08-06T13:50:02.077", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1113DB3C-BD71-42ED-A4AF-0098AA744FD8", "versionEndExcluding": "13.06"}], "operator": "OR"}]}], "sourceIdentifier": "SecurityResponse@netmotionsoftware.com"}