CVE-2025-27706

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-27706

3.4 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

C

VE-2025-27706 is a cross-site scripting vulnerability in the management console of Absolute Secure Access prior to version 13.54. Attackers with system administrator permissions can interfere with another system administrator’s use of the management console when the second administrator visits the page. Attack complexity is low, there are no preexisting attack requirements, privileges required are high and active user interaction is required. There is no impact on confidentiality, the impact on integrity is low and there is no impact on availability.

References
Link Resource
https://www.absolute.com/platform/vulnerability-archive/cve-2025-27706 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*
History

04 Jun 2025, 19:59

Type Values Removed Values Added
References () https://www.absolute.com/platform/vulnerability-archive/cve-2025-27706 - () https://www.absolute.com/platform/vulnerability-archive/cve-2025-27706 - Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 3.4
Summary
  • (es) CVE-2025-27706 es una vulnerabilidad de cross-site scripting en la consola de administración de Absolute Secure Access (versión anterior a la 13.54). Los atacantes con permisos de administrador del sistema pueden interferir con el uso de la consola de administración por parte de otro administrador cuando este visita la página. La complejidad del ataque es baja, no existen requisitos previos, se requieren privilegios altos y se requiere interacción activa del usuario. No hay impacto en la confidencialidad, la integridad ni la disponibilidad.
First Time Absolute secure Access
Absolute
CPE cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*

29 May 2025, 00:15

Type Values Removed Values Added
CWE CWE-79

28 May 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-28 21:15

Updated : 2025-06-04 19:59

NVD link : CVE-2025-27706

Mitre link : CVE-2025-27706

CVE.ORG link : CVE-2025-27706

JSON object : View

Products Affected

absolute

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')