CVE-2023-4932

Summary

CVE-2023-4932: SAS application versions 9.4_M7 and 9.4_M8 are vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient input validation in the `_program` parameter of the `/SASStoredProcess/do` endpoint. This issue allows an attacker to inject and execute arbitrary JavaScript code when an authenticated user opens a specially crafted URL. Although this vulnerability can be exploited by a low-privileged user, its impact on higher privilege levels is yet to be determined. Hot fixes have been released for the affected versions to address this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.