PT-2023-31166
CVE-2023-4932
·
تاريخ النشر
2023-12-12
·
تاريخ التحديث
2023-12-15
الوصف من
CVSS 3.1
6.3
متوسطةالمقاييسAV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Name of the Vulnerable Software and Affected Versions
SAS application versions 9.4 M7 through 9.4 M8
Description
The SAS application is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper input validation in the
program parameter of the "/SASStoredProcess/do" endpoint. This allows arbitrary JavaScript to be executed when a specially crafted URL is opened by an authenticated user. The attack is possible from a low-privileged user.Recommendations
For versions 9.4 M7 and 9.4 M8, apply the published hot fixes to resolve the issue.
As a temporary workaround, consider restricting access to the "/SASStoredProcess/do" endpoint until the hot fix is applied.
Avoid using the
program parameter in the affected endpoint until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾