CVE-2024-37351: Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06
There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with other system administrator’s use of the management UI when the second administrator later edits the same management object. This vulnerability is distinct from CVE-2024-37348 and CVE-2024-37349. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37351?
CVE-2024-37351 is classified as a cross-site scripting vulnerability that can significantly impact system administrators' usability of the management UI.
How do I fix CVE-2024-37351?
To remediate CVE-2024-37351, upgrade Absolute Secure Access to version 13.06 or later.
Who is affected by CVE-2024-37351?
CVE-2024-37351 affects users with system administrator permissions in the management UI of Absolute Secure Access prior to version 13.06.
What are the potential consequences of CVE-2024-37351?
If exploited, CVE-2024-37351 could allow attackers with admin permissions to interfere with other administrators' operations in the management UI.
Is CVE-2024-37351 being actively exploited?
As of now, there are no confirmed reports of active exploitation of CVE-2024-37351.