Lucene search

PRIOn knowledge basePRION:CVE-2023-4932

HistoryDec 12, 2023 - 10:15 a.m.

Cross site scripting

2023-12-1210:15:00

PRIOn knowledge base

www.prio-n.com

sas application

reflected cross-site scripting

vulnerability

endpoint

input validation

hot fixes

javascript

low-privileged user

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.2%

JSON

SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the _program parameter of the the /SASStoredProcess/do endpoint allows arbitrary JavaScript to be executed when specially crafted URL is opened by an authenticated user. The attack is possible from a low-privileged user. Only versions 9.4_M7 and 9.4_M8 were tested and confirmed to be vulnerable, status of others is unknown. For above mentioned versions hot fixes were published.

CPENameOperatorVersion
integration_technologieseq9.4 m8
integration_technologieseq9.4 m7

CPE	Name	Operator	Version
	integration_technologies	eq	9.4 m8
	integration_technologies	eq	9.4 m7

References

cert.pl/en/posts/2023/12/CVE-2023-4932/

cert.pl/posts/2023/12/CVE-2023-4932/

support.sas.com/kb/70/265.html