PT-2014-6484 · Sas · Sas Visual Analytics

Published 2014-08-25 · Updated 2017-09-08 · CVE-2014-5454

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SAS Visual Analytics version 6.4M1

Description The issue concerns an unrestricted file upload vulnerability in the image upload module. This allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and then accessing it.

Recommendations For SAS Visual Analytics version 6.4M1, consider restricting access to the image upload module until a fix is available, and avoid uploading files with executable extensions to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2014-5454

Affected Products

Sas Visual Analytics

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-5454 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95351 · Note
• http://packetstormsecurity.com/files/127866/SAS-Visual-Analytics-6.4M1-Arbitrary-File-Upload.html · Note