CVE-2023-24724

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored cross site scripting (XSS) vulnerability was discovered in the user management module of the SAS 9.4 Admin Console, due to insufficient validation and sanitization of data input into the user creation and editing form fields. The product name is SAS Web Administration interface (SASAdmin). For the product release, the reported version is 9.4_M2 and the fixed version is 9.4_M3. For the SAS release, the reported version is 9.4 TS1M2 and the fixed version is 9.4 TS1M3.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 3, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-247269.8Art Gallery Management System v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter on the enquiry page.CVE-2023-247288.8Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the contact parameter in the CVE-2023-247298.8Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the address parameter in the CVE-2023-24734.3A vulnerability was found in Dreamer CMS up to 4.1.3. It has been declared as problematic. This vulnerability affects the function updatePwdCVE-2023-247308.8Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the company parameter in the CVE-2023-247318.8Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the query parameter in the usCVE-2023-247328.8Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the gender parameter in the uCVE-2023-247336.1PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_zCVE-2023-247349.8An arbitrary file upload vulnerability in the camera_upload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a craCVE-2023-247356.1PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php. This vulnerability allows attackersCVE-2023-247369.8PMB v7.4.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /sauvegarde/restaure_act.php.CVE-2023-247376.1PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z
CVE-2023-24724: Medium severity, CVSS 5.4 | Vulnix