CVE-2024-40875CWE-79

Cross-site scripting vulnerability in the Secure Access administrative console prior to 13.52

Medium · published December 20, 2024

CVSS v4.0
5.9
EPSS
0%
Percentile
23.2
In the wild
Unconfirmed
What it is

There is a cross-site scripting vulnerability in the

management console of Absolute Secure Access prior to version 13.52. Attackers

with system administrator permissions can interfere with another system

administrator’s use of the management console when the second administrator logs

in. Attack complexity is high, attack requirements are present, privileges

required are high, user interaction required is none. The impact to

confidentiality is none, the impact to availability is low, and the impact to

system integrity is high.

The record
Technical detail
CVSS v4.0
5.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00316 · 23.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-12-20T20:17Z
EPSS history
Timeline
  • 20 DEC 20:17Z
    Cross-site scripting vulnerability in the Secure Access administrative console prior to 13.52
    cvelistv5