Secure Access
CVE-2024-37351
LOW
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with other system administrator’s use of the management UI when the second administrator later edits the same management object. This vulnerability is distinct from CVE-2024-37348 and CVE-2024-37349. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none.
AnalysisAI
There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with other system administrator’s use of the management UI when the second administrator later edits the same management object. This vulnerability is distinct from CVE-2024-37348 and CVE-2024-37349. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none. Affected products include: Absolute Secure Access. Version information: version 13.06..
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
More in Secure Access
View allPersistent denial-of-service in Absolute Secure Access servers before version 14.55 allows a remote attacker with deep,
Local privilege escalation in Absolute Secure Access for Windows (client and server) before version 14.55 allows a low-p
Memory management vulnerability in Absolute Secure Access server versions 9.0 through 13.54 that allows unauthenticated,
Secure Access Server versions before 14.20 are vulnerable to a network-based denial-of-service attack where unauthentica
Buffer overflow in Absolute Secure Access server (versions before 14.50) allows authenticated remote attackers with modi
Persistent denial-of-service in Absolute Secure Access servers before version 14.55 allows an authenticated tunnel parti
Memory management flaw in Absolute Secure Access prior to version 14.55 allows a remote attacker with deep protocol know
Non-persistent denial-of-service against Absolute Secure Access servers prior to version 14.55 is achievable by an attac
Heap overflow in Absolute Security Secure Access client certificate parsing causes a local denial of service. Versions p
CVE-2025-54088 is an open-redirect vulnerability in Secure Access prior to version 14.10. Attackers with access to the c
Frameable content on the Absolute Secure Access server login page (versions prior to 14.55) enables clickjacking attacks
There is a cross-site scripting vulnerability in the Secure Access administrative UI of Absolute Secure Access prior to
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today