Problem Note 55539: The SAS® 9.4 Web Administration interface contains a cross-site scripting vulnerability.
 |  |  |  |  |
Severity: Medium
Description: The notification-template functionality of the SAS Web Administration interface (SASAdmin) contains a cross-site scripting vulnerability.
Potential Impact: Users might unknowingly execute malicious code.
Solution: A temporary workaround is available for this issue. To disable the affected functionality:
- Remove the SASTemplateEditor.xml file from the following directory:
SAS-configuration-directory/LevN/Web/WebAppServer/SASServer1_1/conf/Catalina/localhost
- Restart the SAS® Web Application Server.
These steps leave the majority of the SASAdmin web application functional while only disabling the functionality that is related to notifications.
Click the Hot Fix tab in this note to access the hot fix for this issue.
Operating System and Release Information
| Product Family | Product | System | Product Release | SAS Release | ||
| Reported | Fixed* | Reported | Fixed* | |||
| SAS System | SAS Web Infrastructure Platform | Microsoft® Windows® for x64 | 9.4_M2 | 9.4_M3 | 9.4 TS1M2 | 9.4 TS1M3 |
| 64-bit Enabled AIX | 9.4_M2 | 9.4_M3 | 9.4 TS1M2 | 9.4 TS1M3 | ||
| 64-bit Enabled Solaris | 9.4_M2 | 9.4_M3 | 9.4 TS1M2 | 9.4 TS1M3 | ||
| HP-UX IPF | 9.4_M2 | 9.4_M3 | 9.4 TS1M2 | 9.4 TS1M3 | ||
| Linux for x64 | 9.4_M2 | 9.4_M3 | 9.4 TS1M2 | 9.4 TS1M3 | ||
| Solaris for x64 | 9.4_M2 | 9.4_M3 | 9.4 TS1M2 | 9.4 TS1M3 | ||
A fix for this issue for SAS Middle Tier 9.4_M2 is available at:
https://tshf.sas.com/techsup/download/hotfix/HF2/R75.html#55539A fix for this issue for SAS Management Console 9.4_M1 is available at:
https://tshf.sas.com/techsup/download/hotfix/HF2/M93.html#55539A fix for this issue for SAS Middle Tier 9.4_M1 is available at:
https://tshf.sas.com/techsup/download/hotfix/HF2/M92.html#55539A fix for this issue for SAS Management Console 9.4 is available at:
https://tshf.sas.com/techsup/download/hotfix/HF2/L45.html#55539A fix for this issue for SAS Middle Tier 9.4 is available at:
https://tshf.sas.com/techsup/download/hotfix/HF2/L49.html#55539| Type: | Problem Note |
| Priority: | high |
| Date Modified: | 2015-04-15 08:31:26 |
| Date Created: | 2015-04-10 11:37:49 |