Medium severity · published Jun 20, 2024
CVE-2024-37346
Insufficient input validation vulnerability in the Absolute Secure Access Warehouse prior to 13.06
4.9
CVSS
0.4%
EPSS
No
On KEV
Description
There is an insufficient input validation vulnerability in
the Warehouse component of Absolute Secure Access prior to 13.06. Attackers
with system administrator permissions can impair the availability of certain
elements of the Secure Access administrative UI by writing invalid data to the
warehouse over the network. There is no loss of warehouse integrity or
confidentiality, the security scope is unchanged. Loss of availability is high.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Secure Access · Absolute Software
before 13.06 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-37346
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-37346
Vendor Advisory
https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37346/
More from Secure Access
9.8
CVE-2026-33447
CVE-2026-33447 is a buffer overflow in a message parsing function of the Secure Access client prior to 14.50
9.8
CVE-2026-33446
Buffer overflow in client authentication prior to version 14.50
7.8
CVE-2026-33451
Arbitrary read/write vulnerability in Windows clients prior to 14.50
7.5
CVE-2026-33449
Message handler buffer overflow in clients prior to 14.50
6.5
CVE-2026-40950
Buffer overflow in the Secure Access server prior to 14.50