CVE-2024-40875

There is a cross-site scripting vulnerability in the management console of Absolute Secure Access prior to version 13.52. Attackers with system administrator permissions can interfere with another system administrator’s use of the management console when the second administrator logs in. Attack complexity is high, attack requirements are present, privileges required are high, user interaction required is none. The impact to confidentiality is none, the impact to availability is low, and the impact to system integrity is high.

CVSS

No CVSS.

References

Link	Resource
https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1352/

Configurations

No configuration.

History

No history.

Information

Published : 2024-12-20 21:15

Updated : 2026-06-17 07:46

NVD link : CVE-2024-40875

Mitre link : CVE-2024-40875

CVE.ORG link : CVE-2024-40875

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-40875", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-40875", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-24T15:56:55.279442Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "SecurityResponse@netmotionsoftware.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "SecurityResponse@netmotionsoftware.com", "affectedData": [{"vendor": "Absolute Software", "modules": ["Management Console"], "product": "Secure Access", "versions": [{"status": "affected", "version": "0", "lessThan": "13.52", "versionType": "Server"}], "defaultStatus": "unaffected"}]}], "published": "2024-12-20T21:15:08.290", "references": [{"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1352/", "source": "SecurityResponse@netmotionsoftware.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "SecurityResponse@netmotionsoftware.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "There is a cross-site scripting vulnerability in the\nmanagement console of Absolute Secure Access prior to version 13.52. Attackers\nwith system administrator permissions can interfere with another system\nadministrator\u2019s use of the management console when the second administrator logs\nin. Attack complexity is high, attack requirements are present, privileges\nrequired are high, user interaction required is none. The impact to\nconfidentiality is none, the impact to availability is low, and the impact to\nsystem integrity is high."}, {"lang": "es", "value": "Existe una vulnerabilidad de cross site scripting en management console de Absolute Secure Access anterior a la versi\u00f3n 13.52. Los atacantes con permisos de administrador del sistema pueden interferir con el uso de la consola de administraci\u00f3n por parte de otro administrador del sistema cuando el segundo administrador inicia sesi\u00f3n. La complejidad del ataque es alta, existen requisitos de ataque, se requieren muchos privilegios y no se requiere interacci\u00f3n del usuario. El impacto en la confidencialidad es nulo, el impacto en la disponibilidad es bajo y el impacto en la integridad del sistema es alto."}], "lastModified": "2026-06-17T07:46:47.350", "sourceIdentifier": "SecurityResponse@netmotionsoftware.com"}