62499 - In SAS® Web Report Studio, the section name field contains a cross-site scripting vulnerability

Problem Note 62499: In SAS® Web Report Studio, the section name field contains a cross-site scripting vulnerability

Severity: Low

Description: SAS Web Report Studio might allow injection of malicious scripts into the section name field.

Potential Impact: Malicious code might be executed if users click on a URL that has been specially crafted by an attacker.

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

Product Family	Product	System	Product Release		SAS Release
Product Family	Product	System	Reported	Fixed*	Reported	Fixed*
SAS System	SAS Web Report Studio	Microsoft® Windows® for x64	4.4_M3	4.4_M7	9.4 TS1M3	9.4 TS1M7
		64-bit Enabled AIX	4.4_M3	4.4_M7	9.4 TS1M3	9.4 TS1M7
		64-bit Enabled Solaris	4.4_M3	4.4_M7	9.4 TS1M3	9.4 TS1M7
		HP-UX IPF	4.4_M3	4.4_M7	9.4 TS1M3	9.4 TS1M7
		Linux for x64	4.4_M3	4.4_M7	9.4 TS1M3	9.4 TS1M7
		Solaris for x64	4.4_M3	4.4_M7	9.4 TS1M3	9.4 TS1M7

* For software releases that are not yet generally available, the Fixed Release is the software release in which the problem is planned to be fixed.

A fix for this issue for SAS Web Report Viewer 4.4_M6 is available at:

A fix for this issue for SAS Web Report Studio 4.4_M6 is available at:

A fix for this issue for SAS Web Report Studio 4.4_M5 is available at:

A fix for this issue for SAS Web Report Viewer 4.4_M5 is available at:

A fix for this issue for SAS Web Report Studio 4.4_M4 is available at:

A fix for this issue for SAS Web Report Viewer 4.4_M4 is available at:

A fix for this issue for SAS Web Report Studio 4.4_M3 is available at:

A fix for this issue for SAS Web Report Viewer 4.4_M3 is available at:

Type:	Problem Note
Priority:	high

Date Modified:	2018-06-29 09:44:09
Date Created:	2018-06-21 10:18:46