PT-2014-6484 · Sas · Sas Visual Analytics

Publicado 2014-08-25 · Atualizado 2017-09-08 · CVE-2014-5454

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SAS Visual Analytics version 6.4M1

Description The issue concerns an unrestricted file upload vulnerability in the image upload module. This allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and then accessing it.

Recommendations For SAS Visual Analytics version 6.4M1, consider restricting access to the image upload module until a fix is available, and avoid uploading files with executable extensions to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2014-5454

Produtos afetados

Sas Visual Analytics

Referências · 3

• https://exchange.xforce.ibmcloud.com/vulnerabilities/95351 · Nota
• http://packetstormsecurity.com/files/127866/SAS-Visual-Analytics-6.4M1-Arbitrary-File-Upload.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-5454 · Nota de Segurança