PT-2023-31166 · Sas Institute · Sas

Maksymilian Kubiak + 1 · Publicado 2023-12-12 · Atualizado 2023-12-15 · CVE-2023-4932

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions SAS application versions 9.4 M7 through 9.4 M8

Description The SAS application is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper input validation in the program parameter of the "/SASStoredProcess/do" endpoint. This allows arbitrary JavaScript to be executed when a specially crafted URL is opened by an authenticated user. The attack is possible from a low-privileged user.

Recommendations For versions 9.4 M7 and 9.4 M8, apply the published hot fixes to resolve the issue. As a temporary workaround, consider restricting access to the "/SASStoredProcess/do" endpoint until the hot fix is applied. Avoid using the program parameter in the affected endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-4932

Produtos afetados

Sas

Referências · 7

• https://t.me/cvenotify/63743 · Publicação no Telegram
• https://cert.pl/en/posts/2023/12/CVE-2023-4932 · Nota
• https://twitter.com/CVEnew/status/1734518497496236153 · Publicação no Twitter
• https://cert.pl/posts/2023/12/CVE-2023-4932 · Nota
• https://support.sas.com/kb/70/265.html · Correção, Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-4932 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-4932 · Nota de Segurança