SAS Studio vulnerabilities
3 known CVE vulnerabilities in SAS Studio, translated and rated.
- CVE-2024-48735High
A Directory Traversal vulnerability in SAS Studio 9.4 allows a remote attacker to access internal files by manipulating the default path during file download. The attack requires knowledge of the session ID and internal path.
- CVE-2024-48734High
Unrestricted file upload in SAS Studio 9.4 via the path /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} may allow a remote attacker to upload malicious files. The vendor disputes this, stating that file upload is only allowed for authorized users.
- CVE-2024-48733High
SQL injection vulnerability in SAS Studio 9.4 at /SASStudio/sasexec/sessions/{sessionID}/sql allows a remote attacker to execute arbitrary SQL commands via the POST body request. The vendor disputes this, stating that SQL statement execution is allowed for authorized users.