Severity: High
Description: The Export to Excel feature of the web application might enable injection of malicious scripts into a cell of a Microsoft Excel spreadsheet.
Potential Impact: Users might unknowingly execute malicious code.

Click the Hot Fix tab in this note to access the hot fix for this issue.

With this fix, the web application escapes the text for any cell whose value begins with one of the following characters:

After you install the hot fix, you can specify additional characters to escape, by specifying the following configuration property in the configdata.properties file:

For example, if you would like to escape the # character, you would add the character to the list of default characters, as shown in the following example:

Operating System and Release Information

A fix for this issue for SAS Risk Governance Framework 7.3 is available at:

A fix for this issue for SAS Model Risk Management 7.3 is available at:

A fix for this issue for SAS Model Risk Management 7.2 is available at:

A fix for this issue for SAS Model Risk Management 7.1 is available at:

A fix for this issue for SAS Model Risk Management 6.1 is available at:

A fix for this issue for SAS Enterprise GRC 6.1 is available at:

A fix for this issue for SAS Enterprise GRC 5.1_M5 is available at:

A fix for this issue for SAS Enterprise GRC 5.1_M5 is available at: