CVE-2023-4932

MEDIO 5.4CVE-2023-4932 · Published 12/12/2023 · updated 17/06/2026

In breve

CVE-2023-4932 è una vulnerabilità MEDIO (CVSS 5.4) che riguarda integration technologies (sas).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.63%, superiore al 50.4% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
integration technologies sas	`= 9.4`	No fix yet

Description

SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SASStoredProcess/do` endpoint allows arbitrary JavaScript to be executed when specially crafted URL is opened by an authenticated user. The attack is possible from a low-privileged user. Only versions 9.4_M7 and 9.4_M8 were tested and confirmed to be vulnerable, status of others is unknown. For above mentioned versions hot fixes were published.

References

cert.pl/en/posts/2023/12/CVE-2023-4932 · Third Party Advisory
cert.pl/posts/2023/12/CVE-2023-4932 · Third Party Advisory
support.sas.com/kb/70/265.html · Vendor Advisory

Altre vulnerabilità di integration technologies

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

integration technologies

sas

= 9.4

No fix yet

Description

Altre vulnerabilità di integration technologies

Vedi tutto →