Low severity · published Jun 20, 2024
CVE-2024-37349
Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06
3.4
CVSS
0.3%
EPSS
No
On KEV
Description
There is a cross-site scripting vulnerability in the
management UI of Absolute Secure Access prior to version 13.06. Attackers with
system administrator permissions can interfere with other system
administrator’s use of the management UI when the victim administrator edits
the same management object. This vulnerability is distinct from CVE-2024-37348 and
CVE-2024-37351. The scope is unchanged, there is no loss of confidentiality. Impact
to system integrity is high, impact to system availability is none.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Secure Access · Absolute Software
before 13.06 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-37349
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-37349
Vendor Advisory
https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37349/
More from Secure Access
9.8
CVE-2026-33447
CVE-2026-33447 is a buffer overflow in a message parsing function of the Secure Access client prior to 14.50
9.8
CVE-2026-33446
Buffer overflow in client authentication prior to version 14.50
7.8
CVE-2026-33451
Arbitrary read/write vulnerability in Windows clients prior to 14.50
7.5
CVE-2026-33449
Message handler buffer overflow in clients prior to 14.50
6.5
CVE-2026-40950
Buffer overflow in the Secure Access server prior to 14.50