There is a security vulnerability in SAS Marketing Optimization whereby SQL queries are being run on the SAS Web Application Server without validation.

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

Product Family	Product	System	Product Release		SAS Release
			Reported	Fixed*	Reported	Fixed*
SAS System	SAS Marketing Optimization	Solaris for x64	6.3		9.4 TS1M3
		Linux for x64	6.3		9.4 TS1M3
		HP-UX IPF	6.3		9.4 TS1M3
		64-bit Enabled Solaris	6.3		9.4 TS1M3
		64-bit Enabled AIX	6.3		9.4 TS1M3
		Microsoft® Windows® for x64	6.3		9.4 TS1M3

* For software releases that are not yet generally available, the Fixed Release is the software release in which the problem is planned to be fixed.

---

A fix for this issue for SAS Marketing Optimization 6.3 is available at:

https://tshf.sas.com/techsup/download/hotfix/HF2/R88.html#55009

---

It is possible to enter data in SAS Marketing Optimization that has not been validated by the SAS Web Application Server, thereby creating a security vulnerability.

Type:	Problem Note
Priority:	high

Date Modified:	2015-03-10 11:24:37
Date Created:	2015-01-16 11:10:26