CVE-2023-4932: Reflected Cross-Site Scripting in SAS 9.4

First published: Tue Dec 12 2023(Updated: )

SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SASStoredProcess/do` endpoint allows arbitrary JavaScript to be executed when specially crafted URL is opened by an authenticated user. The attack is possible from a low-privileged user. Only versions 9.4_M7 and 9.4_M8 were tested and confirmed to be vulnerable, status of others is unknown. For above mentioned versions hot fixes were published.

Credit: cvd@cert.pl

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-api
• agent/author
• agent/severity
• agent/references
• agent/weakness
• agent/title
• agent/tags
• agent/type
• agent/event
• agent/description
• agent/last-modified-date
• agent/softwarecombine
• agent/first-publish-date
• collector/mitre-cve
• source/MITRE
• vendor/sas
• canonical/sas integration technologies
• version/sas integration technologies/9.4-m7
• version/sas integration technologies/9.4-m8