{"id":"CVE-2024-40873","state":"PUBLISHED","title":"XSS in Secure Access administrative console","description":"There is a cross-site scripting vulnerability in the Secure\nAccess administrative console of Absolute Secure Access prior to version 13.07.\nAttackers with system administrator permissions can interfere with another\nsystem administrator’s use of the publishing UI when the administrators are\nediting the same management object. The scope is unchanged, there is no loss of\nconfidentiality. Impact to system availability is none, impact to system\nintegrity is high.","publishedAt":"2024-07-25T17:19:28.906Z","updatedAt":"2024-08-02T04:39:55.361Z","severity":{"score":4.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","source":"Absolute"},"assigner":"Absolute","products":["Absolute Security Secure Access"],"affected":[{"vendor":"Absolute Security","product":"Secure Access","packageName":"Console","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"13.07","versionType":"server"}]}],"references":["https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1307/cve-2024-40873/"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/40xxx/CVE-2024-40873.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-40873","state":"PUBLISHED","datePublished":"2024-07-25T17:19:28.906Z","dateUpdated":"2024-08-02T04:39:55.361Z","assignerShortName":"Absolute","assignerOrgId":"b6533044-ea05-4482-8458-7bddeca0d079","dateReserved":"2024-07-10T20:40:17.120Z"},"containers":{"cna":{"title":"XSS in Secure Access administrative console","descriptions":[{"lang":"en","value":"There is a cross-site scripting vulnerability in the Secure\nAccess administrative console of Absolute Secure Access prior to version 13.07.\nAttackers with system administrator permissions can interfere with another\nsystem administrator’s use of the publishing UI when the administrators are\nediting the same management object. The scope is unchanged, there is no loss of\nconfidentiality. Impact to system availability is none, impact to system\nintegrity is high."}],"affected":[{"vendor":"Absolute Security","product":"Secure Access","packageName":"Console","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"13.07","versionType":"server"}]}],"references":[{"url":"https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1307/cve-2024-40873/"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Absolute","orgId":"b6533044-ea05-4482-8458-7bddeca0d079","dateUpdated":"2024-07-25T17:19:28.906Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-25T17:44:12.839094Z","id":"CVE-2024-40873","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-25T17:44:19.838Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1307/cve-2024-40873/","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T04:39:55.361Z"}}]}}}