CVE-2023-4932: Reflected Cross-Site Scripting in SAS 9.4
SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the program parameter of the the /SASStoredProcess/do endpoint allows arbitrary JavaScript to be executed when specially crafted URL is opened by an authenticated user. The attack is possible from a low-privileged user. Only versions 9.4M7 and 9.4M8 were tested and confirmed to be vulnerable, status of others is unknown. For above mentioned versions hot fixes were published.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4932?
CVE-2023-4932 is classified as a high-severity vulnerability due to its potential for reflected cross-site scripting (XSS) attacks.
How do I fix CVE-2023-4932?
To fix CVE-2023-4932, ensure that proper input validation and sanitization are implemented for the `_program` parameter in the `/SASStoredProcess/do` endpoint.
Which SAS versions are affected by CVE-2023-4932?
CVE-2023-4932 affects SAS Integration Technologies versions 9.4-M7 and 9.4-M8.
What is reflected cross-site scripting in the context of CVE-2023-4932?
Reflected cross-site scripting in CVE-2023-4932 allows attackers to inject and execute arbitrary JavaScript through specially crafted URLs opened by authenticated users.
Who is at risk due to CVE-2023-4932?
Authenticated users of SAS applications using the affected versions are at risk of being targeted by this reflected XSS vulnerability.