« Volver al listado

CVE-2024-37350

Estado: ModificadaMedia (4.7)—

There is a cross-site scripting vulnerability in the policy management UI of Absolute Secure Access prior to version 13.06. Attackers can interfere with a system administrator’s use of the policy management UI when the attacker convinces the victim administrator to follow a crafted link to the vulnerable component while the attacking administrator is authenticated to the console. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Absolute — Secure Access

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-37350",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-37350",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-21T16:14:37.157939Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "SecurityResponse@netmotionsoftware.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "SecurityResponse@netmotionsoftware.com",
      "affectedData": [
        {
          "vendor": "Absolute Software",
          "product": "Secure Access",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "13.06",
              "versionType": "Server"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-06-20T18:15:12.103",
  "references": [
    {
      "url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37350/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "SecurityResponse@netmotionsoftware.com"
    },
    {
      "url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37350/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "SecurityResponse@netmotionsoftware.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is a cross-site scripting vulnerability in the policy\nmanagement UI of Absolute Secure Access prior to version 13.06. Attackers can\ninterfere with a system administrator’s use of the policy management UI when\nthe attacker convinces the victim administrator to follow a crafted link to the\nvulnerable component while the attacking administrator is authenticated to the\nconsole. The scope is unchanged, there is no loss of confidentiality. Impact to\nsystem integrity is high, impact to system availability is none."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de Cross Site Scripting en la interfaz de usuario de administración de políticas de Absolute Secure Access antes de la versión 13.06. Los atacantes pueden interferir con el uso de la interfaz de usuario de administración de políticas por parte de un administrador del sistema cuando el atacante convence al administrador de la víctima de seguir un enlace manipulado al componente vulnerable mientras el administrador atacante está autenticado en la consola. El alcance no cambia, no hay pérdida de confidencialidad. El impacto en la integridad del sistema es alto, el impacto en la disponibilidad del sistema es nulo."
    }
  ],
  "lastModified": "2026-06-17T07:38:11.947",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1113DB3C-BD71-42ED-A4AF-0098AA744FD8",
              "versionEndExcluding": "13.06"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "SecurityResponse@netmotionsoftware.com"
}