SUPPORT / SAMPLES & SAS NOTES
Problem Note 62876: SAS® Web Report Studio images contain a cross-site scripting vulnerability
 |  |  |  |  |
Severity: Medium
Description: SAS Web Report Studio might allow injection of malicious scripts when adding images.
Potential Impact: Users might unknowingly execute malicious code.
Click the Hot Fix tab in this note to access the hot fix for this issue. After the hot fix is applied, SAS Web Report Studio displays HTTP 500 if someone attempts this exploit.
Operating System and Release Information
| Product Family | Product | System | Product Release | SAS Release | ||
| Reported | Fixed* | Reported | Fixed* | |||
| SAS System | SAS Web Report Studio | Microsoft® Windows® for x64 | 4.4_M3 | 4.4_M6 | 9.4 TS1M3 | 9.4 TS1M6 |
| 64-bit Enabled AIX | 4.4_M3 | 4.4_M6 | 9.4 TS1M3 | 9.4 TS1M6 | ||
| 64-bit Enabled Solaris | 4.4_M3 | 4.4_M6 | 9.4 TS1M3 | 9.4 TS1M6 | ||
| HP-UX IPF | 4.4_M3 | 4.4_M6 | 9.4 TS1M3 | 9.4 TS1M6 | ||
| Linux for x64 | 4.4_M3 | 4.4_M6 | 9.4 TS1M3 | 9.4 TS1M6 | ||
| Solaris for x64 | 4.4_M3 | 4.4_M6 | 9.4 TS1M3 | 9.4 TS1M6 | ||