CVE-2024-37352 json
Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06
published 2024-06-20 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-36609
- cvss
- 4.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 19%
- public exploits
- 0
- none known
Summary
There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06 that allows attackers with system administrator permissions to interfere with other system administrators’ use of the management UI when the second administrator accesses the vulnerable page. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none.
Patch / fix
- Absolute Software Secure Access 13.06
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 3.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N |
Affected products
- Absolute Software Secure Access
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
Sources
- CVE List CVE-2024-37352
- NVD CVE-2024-37352
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.