CVE-2024-48735

Directory Traversal in /SASStudio/sasexec/sessions/sessionID/workspace/InternalPath in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized...

CVE-2024-48733

SQL injection vulnerability in /SASStudio/sasexec/sessions/sessionID/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users...

CVE-2024-48734

Unrestricted file upload in /SASStudio/SASStudio/sasexec/sessionID/InternalPath in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users...

CVE-2024-48733

SQL injection vulnerability in /SASStudio/sasexec/sessions/sessionID/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users...

CVE-2024-48733

SQL injection vulnerability in /SASStudio/sasexec/sessions/sessionID/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users...

CVE-2024-48735

Directory Traversal in /SASStudio/sasexec/sessions/sessionID/workspace/InternalPath in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized...

CVE-2024-48734

Unrestricted file upload in /SASStudio/SASStudio/sasexec/sessionID/InternalPath in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users...

CVE-2024-48734

Unrestricted file upload in /SASStudio/SASStudio/sasexec/sessionID/InternalPath in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users...

CVE-2024-48735

Directory Traversal in /SASStudio/sasexec/sessions/sessionID/workspace/InternalPath in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized...

PT-2024-33195 · Sas · Sas Studio

Name of the Vulnerable Software and Affected Versions: SAS Studio version 9.4 Description: The issue allows a remote attacker to access internal files by manipulating the default path during file download through the /SASStudio/sasexec/sessions/sessionID/workspace/InternalPath endpoint, using...

CVE-2024-48733

A SQL injection vulnerability exists in the /SASStudio/sasexec/sessions/{sessionID}/sql endpoint of SAS Studio version 9.4 . A remote attacker can exploit this by sending a POST body request to execute arbitrary SQL commands. The vendor disputes this vulnerability, noting that SQL statement execu...

CVE-2024-48735

A Directory Traversal vulnerability exists in SAS Studio version 9.4 within the /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} endpoint. A remote attacker could potentially access internal files by manipulating the default path during a file download process. Notably, the vendor...

CVE-2024-48735

Directory Traversal in /SASStudio/sasexec/sessions/sessionID/workspace/InternalPath in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized...

CVE-2024-48735

Directory Traversal in /SASStudio/sasexec/sessions/sessionID/workspace/InternalPath in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized...

PT-2024-33193

Name of the Vulnerable Software and Affected Versions SAS Studio version 9.4 Description A SQL injection issue exists in the /SASStudio/sasexec/sessions/sessionID/sql endpoint of SAS Studio, allowing a remote attacker to execute arbitrary SQL commands via the POST body request. This issue is...

CVE-2024-48735: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal in /SASStudio/sasexec/sessions/sessionID/workspace/InternalPath in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized...

CVE-2024-48734

The SAS Studio 9.4 web-based programming environment is affected by an unrestricted file upload vulnerability in the /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} endpoint. This flaw allows a remote attacker to upload malicious files, although the vendor disputes the vulnerability as fi...

CVE-2024-48734

Unrestricted file upload in /SASStudio/SASStudio/sasexec/sessionID/InternalPath in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users...

CVE-2024-48734: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload in /SASStudio/SASStudio/sasexec/sessionID/InternalPath in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users...

CVE-2024-48734

Unrestricted file upload in /SASStudio/SASStudio/sasexec/sessionID/InternalPath in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users...