CVE-2023-4932 MEDIUM

CVE-2023-4932: Reflected Cross-Site Scripting in SAS 9.4

Vendor Sas Institute
Product SAS Integration Technologies
Weakness CWE-79 · XSS
Published December 12, 2023
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

What the vulnerability does

01Description

SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SASStoredProcess/do` endpoint allows arbitrary JavaScript to be executed when specially crafted URL is opened by an authenticated user. The attack is possible from a low-privileged user. Only versions 9.4_M7 and 9.4_M8 were tested and confirmed to be vulnerable, status of others is unknown. For above mentioned versions hot fixes were published.

Key dates

02Disclosure timeline

December 12, 2023 CVE published
August 2, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-1151 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Stored Cross-Site Scripting Vulnerabilities CVE-2026-28099 WordPress UberSlider Ultra plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2022-0965 Stored XSS viva .ofd file upload in star7th/showdoc CVE-2024-1988 Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-2160 SourceCodester Simple Responsive Tourism Website Master.php cross site scripting