CVE-2023-4932

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SASStoredProcess/do` endpoint allows arbitrary JavaScript to be executed when specially crafted URL is opened by an authenticated user. The attack is possible from a low-privileged user. Only versions 9.4_M7 and 9.4_M8 were tested and confirmed to be vulnerable, status of others is unknown. For above mentioned versions hot fixes were published.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SAS Institute	SAS Integration Technologies	>= 9.4_M7, <= 9.4_M8

References

https://cert.pl/en/posts/2023/12/CVE-2023-4932/Third Party Advisory
https://cert.pl/posts/2023/12/CVE-2023-4932/Third Party Advisory
https://support.sas.com/kb/70/265.htmlVendor Advisory
https://cert.pl/en/posts/2023/12/CVE-2023-4932/Third Party Advisory
https://cert.pl/posts/2023/12/CVE-2023-4932/Third Party Advisory
https://support.sas.com/kb/70/265.htmlVendor Advisory

Timeline

Published: Dec 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-493215.3Certain WithSecure products allow a Denial of Service because scanning a crafted file takes a long time, and causes the scanner to hang. Thi CVE-2023-493227.5Certain WithSecure products allow a Denial of Service because there is an unpack handler crash that can lead to a scanning engine crash. Thi CVE-2023-493287.2On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve CVE-2023-493297.2Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This a CVE-2023-49335.3The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job CVE-2023-493308.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while getting aggregate report data.CVE-2023-493318.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option.CVE-2023-493328.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares.CVE-2023-493338.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature.CVE-2023-493348.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report.CVE-2023-493358.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details.CVE-2023-493374.8Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. (8.5 and earlier are unaffected.)