CVE-2023-24724: XSS
First published: Mon Apr 03 2023(Updated: )
A stored cross site scripting (XSS) vulnerability was discovered in the user management module of the SAS 9.4 Admin Console, due to insufficient validation and sanitization of data input into the user creation and editing form fields. The product name is SAS Web Administration interface (SASAdmin). For the product release, the reported version is 9.4_M2 and the fixed version is 9.4_M3. For the SAS release, the reported version is 9.4 TS1M2 and the fixed version is 9.4 TS1M3.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAS Web Administration interface | =9.4-m2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://medium.com/@williamamorim256/stored-xss-vulnerability-discovered-in-sas-9-4-admin-console-5680e9e4062c
- https://owasp.org/www-community/attacks/xss/
- https://support.sas.com/kb/55/539.html
- https://medium.com/%40williamamorim256/stored-xss-vulnerability-discovered-in-sas-9-4-admin-console-5680e9e4062c
Frequently Asked Questions
What is the severity of CVE-2023-24724?
The severity of CVE-2023-24724 is medium with a severity value of 5.4.
What is the affected software for CVE-2023-24724?
The affected software for CVE-2023-24724 is SAS Web Administration interface 9.4-m2.
What is the CWE category for CVE-2023-24724?
The CWE category for CVE-2023-24724 is CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How can I fix the stored cross site scripting vulnerability in SAS Web Administration interface 9.4-m2?
To fix the vulnerability, update SAS Web Administration interface to a version that includes proper validation and sanitization of user input.
Where can I find more information about stored cross site scripting vulnerabilities?
You can find more information about stored cross site scripting vulnerabilities on the OWASP website.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/event
- agent/references
- agent/severity
- agent/author
- agent/description
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/sas
- canonical/sas web administration interface
- version/sas web administration interface/9.4-m2