PT-2024-27494 · Unknown · Absolute Secure Access

Published 2024-06-20 · Updated 2024-09-09 · CVE-2024-37350

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Absolute Secure Access versions prior to 13.06

Description There is a cross-site scripting issue in the policy management UI. Attackers can interfere with a system administrator's use of the policy management UI when the attacker convinces the victim administrator to follow a crafted link to the vulnerable component while the attacking administrator is authenticated to the console. The scope is unchanged, with no loss of confidentiality, but the impact to system integrity is high, and there is no impact to system availability.

Recommendations For versions prior to 13.06, upgrade to version 13.06 to mitigate the cross-site scripting vulnerability in the policy management UI. As a temporary workaround, consider restricting access to the policy management UI to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-37350

Affected Products

Absolute Secure Access

References · 8

• https://absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37350 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37350 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37350 · Security Note
• https://twitter.com/CVEnew/status/1803842134455279783 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1803965417687269386 · Twitter Post
• https://twitter.com/linuxpatch/status/1803867511860965605 · Twitter Post
• https://t.me/cvenotify/93787 · Telegram Post
• https://t.me/cvenotify/83906 · Telegram Post