PT-2023-31166 · Sas Institute · Sas

Maksymilian Kubiak + 1 · Published 2023-12-12 · Updated 2023-12-15 · CVE-2023-4932

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions SAS application versions 9.4 M7 through 9.4 M8

Description The SAS application is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper input validation in the program parameter of the "/SASStoredProcess/do" endpoint. This allows arbitrary JavaScript to be executed when a specially crafted URL is opened by an authenticated user. The attack is possible from a low-privileged user.

Recommendations For versions 9.4 M7 and 9.4 M8, apply the published hot fixes to resolve the issue. As a temporary workaround, consider restricting access to the "/SASStoredProcess/do" endpoint until the hot fix is applied. Avoid using the program parameter in the affected endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-4932

Affected Products

Sas

References · 7

• https://osv.dev/vulnerability/CVE-2023-4932 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4932 · Security Note
• https://t.me/cvenotify/63743 · Telegram Post
• https://cert.pl/en/posts/2023/12/CVE-2023-4932 · Note
• https://twitter.com/CVEnew/status/1734518497496236153 · Twitter Post
• https://cert.pl/posts/2023/12/CVE-2023-4932 · Note
• https://support.sas.com/kb/70/265.html · Patch, Vendor Advisory