{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-37346",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-25T15:24:52.742650Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-25T15:24:58.961Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:50:55.993Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37346/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Secure Access",
          "vendor": "Absolute Software",
          "versions": [
            {
              "lessThan": "13.06",
              "status": "affected",
              "version": "0",
              "versionType": "Server"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThere is an insufficient input validation vulnerability in\nthe Warehouse component of Absolute Secure Access prior to 13.06. Attackers\nwith system administrator permissions can impair the availability of certain\nelements of the Secure Access administrative UI by writing invalid data to the\nwarehouse over the network. There is no loss of warehouse integrity or\nconfidentiality, the security scope is unchanged. Loss of availability is high.\n\u003c/p\u003e\n\n\n\n\n\n"
            }
          ],
          "value": "There is an insufficient input validation vulnerability in\nthe Warehouse component of Absolute Secure Access prior to 13.06. Attackers\nwith system administrator permissions can impair the availability of certain\nelements of the Secure Access administrative UI by writing invalid data to the\nwarehouse over the network. There is no loss of warehouse integrity or\nconfidentiality, the security scope is unchanged. Loss of availability is high."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-20T16:51:37.265Z",
        "orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
        "shortName": "Absolute"
      },
      "references": [
        {
          "url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37346/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to Absolute Secure Access v13.06 or later. \u003cbr\u003e"
            }
          ],
          "value": "Upgrade to Absolute Secure Access v13.06 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Insufficient input validation vulnerability in the Absolute Secure Access Warehouse prior to 13.06",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
    "assignerShortName": "Absolute",
    "cveId": "CVE-2024-37346",
    "datePublished": "2024-06-20T16:51:37.265Z",
    "dateReserved": "2024-06-05T21:07:26.876Z",
    "dateUpdated": "2024-08-02T03:50:55.993Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-37346\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-25T15:24:52.742650Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-25T15:24:56.451Z\"}}], \"cna\": {\"title\": \"Insufficient input validation vulnerability in the Absolute Secure Access Warehouse prior to 13.06\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Absolute Software\", \"product\": \"Secure Access\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"13.06\", \"versionType\": \"Server\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to Absolute Secure Access v13.06 or later.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Upgrade to Absolute Secure Access v13.06 or later. \u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37346/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"There is an insufficient input validation vulnerability in\\nthe Warehouse component of Absolute Secure Access prior to 13.06. Attackers\\nwith system administrator permissions can impair the availability of certain\\nelements of the Secure Access administrative UI by writing invalid data to the\\nwarehouse over the network. There is no loss of warehouse integrity or\\nconfidentiality, the security scope is unchanged. Loss of availability is high.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThere is an insufficient input validation vulnerability in\\nthe Warehouse component of Absolute Secure Access prior to 13.06. Attackers\\nwith system administrator permissions can impair the availability of certain\\nelements of the Secure Access administrative UI by writing invalid data to the\\nwarehouse over the network. There is no loss of warehouse integrity or\\nconfidentiality, the security scope is unchanged. Loss of availability is high.\\n\u003c/p\u003e\\n\\n\\n\\n\\n\\n\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"b6533044-ea05-4482-8458-7bddeca0d079\", \"shortName\": \"Absolute\", \"dateUpdated\": \"2024-06-20T16:51:37.265Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-37346\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-06-25T15:24:58.961Z\", \"dateReserved\": \"2024-06-05T21:07:26.876Z\", \"assignerOrgId\": \"b6533044-ea05-4482-8458-7bddeca0d079\", \"datePublished\": \"2024-06-20T16:51:37.265Z\", \"assignerShortName\": \"Absolute\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}