CVE-2023-24724: XSS
A stored cross site scripting (XSS) vulnerability was discovered in the user management module of the SAS 9.4 Admin Console, due to insufficient validation and sanitization of data input into the user creation and editing form fields. The product name is SAS Web Administration interface (SASAdmin). For the product release, the reported version is 9.4M2 and the fixed version is 9.4M3. For the SAS release, the reported version is 9.4 TS1M2 and the fixed version is 9.4 TS1M3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-24724?
The severity of CVE-2023-24724 is medium with a severity value of 5.4.
What is the affected software for CVE-2023-24724?
The affected software for CVE-2023-24724 is SAS Web Administration interface 9.4-m2.
What is the CWE category for CVE-2023-24724?
The CWE category for CVE-2023-24724 is CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How can I fix the stored cross site scripting vulnerability in SAS Web Administration interface 9.4-m2?
To fix the vulnerability, update SAS Web Administration interface to a version that includes proper validation and sanitization of user input.
Where can I find more information about stored cross site scripting vulnerabilities?
You can find more information about stored cross site scripting vulnerabilities on the OWASP website.