Low severity · published Jun 20, 2024
CVE-2024-37344
Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06
3.4
CVSS
0.3%
EPSS
No
On KEV
Description
There is a cross-site scripting vulnerability in the Policy
management UI of Absolute Secure Access prior to version 13.06. Attackers with
system administrator permissions can interfere with another system
administrator’s use of the policy management UI when the administrators are
editing the same policy object. The scope is unchanged, there is no loss of
confidentiality. Impact to system availability is none, impact to system
integrity is high.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Secure Access · Absolute Software
before 13.06 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-37344
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-37344
Vendor Advisory
https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37344/
More from Secure Access
9.8
CVE-2026-33447
CVE-2026-33447 is a buffer overflow in a message parsing function of the Secure Access client prior to 14.50
9.8
CVE-2026-33446
Buffer overflow in client authentication prior to version 14.50
7.8
CVE-2026-33451
Arbitrary read/write vulnerability in Windows clients prior to 14.50
7.5
CVE-2026-33449
Message handler buffer overflow in clients prior to 14.50
6.5
CVE-2026-40950
Buffer overflow in the Secure Access server prior to 14.50