PT-2023-19749 · Sas · Sas 9.4 Admin Console+1

Published 2023-04-03 · Updated 2023-04-11 · CVE-2023-24724

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAS Web Administration interface (SASAdmin) versions 9.4 M2 through 9.4 M2 SAS release versions 9.4 TS1M2 through 9.4 TS1M2

Description A stored cross site scripting (XSS) vulnerability was discovered in the user management module of the SAS 9.4 Admin Console, due to insufficient validation and sanitization of data input into the user creation and editing form fields.

Recommendations For SAS Web Administration interface (SASAdmin) version 9.4 M2, update to version 9.4 M3. For SAS release version 9.4 TS1M2, update to version 9.4 TS1M3.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-24724

Affected Products

Sas 9.4 Admin Console

Sas Web Administration Interface

References · 8

• 🔥 https://medium.com/@williamamorim256/stored-xss-vulnerability-discovered-in-sas-9-4-admin-console-5680e9e4062c · Exploit
• https://osv.dev/vulnerability/CVE-2023-24724 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24724 · Security Note
• https://support.sas.com/kb/55/539.html · Vendor Advisory
• https://medium.com/%40williamamorim256/stored-xss-vulnerability-discovered-in-sas-9-4-admin-console-5680e9e4062c · Note
• https://t.me/cvenotify/47458 · Telegram Post
• https://t.me/cibsecurity/61362 · Telegram Post
• https://owasp.org/www-community/attacks/xss · Note