CVE-2024-37343: Absolute Secure Access

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.06. Attackers with valid tunnel credentials can pass a limited-length script to the administrative console which is then temporarily stored where an administrator using a non-default configuration could click on it while the attacker has a valid tunnel session with the server. The scope is unchanged, there is no loss of confidentiality. Impact to system availability is none, impact to system integrity is high.

Affected products

• Absolute Secure Access: before 13.06 (fixed in 13.06)

Published 2024-06-20. Last modified 2026-06-17.