{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-40873", "assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079", "state": "PUBLISHED", "assignerShortName": "Absolute", "dateReserved": "2024-07-10T20:40:17.120Z", "datePublished": "2024-07-25T17:19:28.906Z", "dateUpdated": "2024-08-02T04:39:55.361Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "Console", "product": "Secure Access", "vendor": "Absolute Security", "versions": [{"lessThan": "13.07", "status": "affected", "version": "0", "versionType": "server"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "There is a cross-site scripting vulnerability in the Secure\nAccess administrative console of Absolute Secure Access prior to version 13.07.\nAttackers with system administrator permissions can interfere with another\nsystem administrator\u2019s use of the publishing UI when the administrators are\nediting the same management object. The scope is unchanged, there is no loss of\nconfidentiality. Impact to system availability is none, impact to system\nintegrity is high."}], "value": "There is a cross-site scripting vulnerability in the Secure\nAccess administrative console of Absolute Secure Access prior to version 13.07.\nAttackers with system administrator permissions can interfere with another\nsystem administrator\u2019s use of the publishing UI when the administrators are\nediting the same management object. The scope is unchanged, there is no loss of\nconfidentiality. Impact to system availability is none, impact to system\nintegrity is high."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "b6533044-ea05-4482-8458-7bddeca0d079", "shortName": "Absolute", "dateUpdated": "2024-07-25T17:19:28.906Z"}, "references": [{"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1307/cve-2024-40873/"}], "source": {"discovery": "UNKNOWN"}, "title": "XSS in Secure Access administrative console", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-25T17:44:12.839094Z", "id": "CVE-2024-40873", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-25T17:44:19.838Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:55.361Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1307/cve-2024-40873/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1307/cve-2024-40873/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:55.361Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40873", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-25T17:44:12.839094Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-25T17:44:16.754Z"}}], "cna": {"title": "XSS in Secure Access administrative console", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Absolute Security", "product": "Secure Access", "versions": [{"status": "affected", "version": "0", "lessThan": "13.07", "versionType": "server"}], "packageName": "Console", "defaultStatus": "unaffected"}], "references": [{"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1307/cve-2024-40873/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "There is a cross-site scripting vulnerability in the Secure\nAccess administrative console of Absolute Secure Access prior to version 13.07.\nAttackers with system administrator permissions can interfere with another\nsystem administrator\u2019s use of the publishing UI when the administrators are\nediting the same management object. The scope is unchanged, there is no loss of\nconfidentiality. Impact to system availability is none, impact to system\nintegrity is high.", "supportingMedia": [{"type": "text/html", "value": "There is a cross-site scripting vulnerability in the Secure\nAccess administrative console of Absolute Secure Access prior to version 13.07.\nAttackers with system administrator permissions can interfere with another\nsystem administrator\u2019s use of the publishing UI when the administrators are\nediting the same management object. The scope is unchanged, there is no loss of\nconfidentiality. Impact to system availability is none, impact to system\nintegrity is high.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b6533044-ea05-4482-8458-7bddeca0d079", "shortName": "Absolute", "dateUpdated": "2024-07-25T17:19:28.906Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40873", "state": "PUBLISHED", "dateUpdated": "2024-08-02T04:39:55.361Z", "dateReserved": "2024-07-10T20:40:17.120Z", "assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079", "datePublished": "2024-07-25T17:19:28.906Z", "assignerShortName": "Absolute"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*", "matchCriteriaId": "4405ED83-48EC-469E-AE8C-12238E862CD4", "versionEndExcluding": "13.07", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "There is a cross-site scripting vulnerability in the Secure\nAccess administrative console of Absolute Secure Access prior to version 13.07.\nAttackers with system administrator permissions can interfere with another\nsystem administrator\u2019s use of the publishing UI when the administrators are\nediting the same management object. The scope is unchanged, there is no loss of\nconfidentiality. Impact to system availability is none, impact to system\nintegrity is high."}, {"lang": "es", "value": "Existe una vulnerabilidad de Cross Site Scripting en la consola administrativa de Secure Access de Absolute Secure Access anterior a la versi\u00f3n 13.07. Los atacantes con permisos de administrador del sistema pueden interferir con el uso de la interfaz de usuario de publicaci\u00f3n por parte de otro administrador del sistema cuando los administradores est\u00e1n editando el mismo objeto de administraci\u00f3n. El alcance no cambia, no hay p\u00e9rdida de confidencialidad. El impacto en la disponibilidad del sistema es nulo, el impacto en la integridad del sistema es alto."}], "id": "CVE-2024-40873", "lastModified": "2024-11-21T09:31:47.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 3.6, "source": "SecurityResponse@netmotionsoftware.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.4, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-07-25T18:15:03.800", "references": [{"source": "SecurityResponse@netmotionsoftware.com", "tags": ["Vendor Advisory"], "url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1307/cve-2024-40873/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1307/cve-2024-40873/"}], "sourceIdentifier": "SecurityResponse@netmotionsoftware.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "SecurityResponse@netmotionsoftware.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}