CVE-2024-48735
HighCVSS 7.7Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
A Directory Traversal vulnerability in SAS Studio 9.4 allows a remote attacker to access internal files by manipulating the default path during file download. The attack requires knowledge of the session ID and internal path.
Risk Assessment
The risk involves potential leakage of sensitive data stored on the server, which could compromise the confidentiality and integrity of organizational information.
Recommendation
It is recommended to restrict access to the /SASStudio/sasexec/sessions/ endpoint with strong authentication and authorization, and to validate file paths server-side.
Other vulnerabilities in SAS Studio
See all- CVE-2024-48734High
Unrestricted file upload in SAS Studio 9.4 via the path /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} may allow a remote attacker to upload malicious files. The vendor disputes this, stating that file upload is only allowed for authorized users.
- CVE-2024-48733High
SQL injection vulnerability in SAS Studio 9.4 at /SASStudio/sasexec/sessions/{sessionID}/sql allows a remote attacker to execute arbitrary SQL commands via the POST body request. The vendor disputes this, stating that SQL statement execution is allowed for authorized users.
Original NVD description (English source)
Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized users.