60381 - A cross-site scripting vulnerability exists in the SAS® Environment Manager administrative application

Problem Note 60381: A cross-site scripting vulnerability exists in the SAS® Environment Manager administrative application

Severity: Medium

Description: A cross-site scripting vulnerability exists in SAS Environment Manager on the List Users page of the administrative application.

Potential Impact: A user can unknowingly execute malicious code.

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

Product Family	Product	System	Product Release		SAS Release
Product Family	Product	System	Reported	Fixed*	Reported	Fixed*
SAS System	SAS Environment Manager	Microsoft® Windows® for x64	2.5	2.5_M2	9.4 TS1M3	9.4 TS1M5
		64-bit Enabled AIX	2.5	2.5_M2	9.4 TS1M3	9.4 TS1M5
		64-bit Enabled Solaris	2.5	2.5_M2	9.4 TS1M3	9.4 TS1M5
		HP-UX IPF	2.5	2.5_M2	9.4 TS1M3	9.4 TS1M5
		Linux for x64	2.5	2.5_M2	9.4 TS1M3	9.4 TS1M5
		Solaris for x64	2.5	2.5_M2	9.4 TS1M3	9.4 TS1M5

* For software releases that are not yet generally available, the Fixed Release is the software release in which the problem is planned to be fixed.

A fix for this issue for SAS Environment Manager 2.5_M1 is available at:

A fix for this issue for SAS Environment Manager 2.5 is available at:

A fix for this issue for SAS Environment Manager 2.3 is available at:

A fix for this issue for SAS Environment Manager 2.1_M1 is available at:

A fix for this issue for SAS Web Server 9.4_M1 is available at:

A fix for this issue for SAS Environment Manager 2.1 is available at:

A fix for this issue for SAS Web Server 9.4 is available at:

Type:	Problem Note
Priority:	high

Date Modified:	2018-04-05 11:38:24
Date Created:	2017-05-01 09:06:01