Severity: Medium

Description: SAS Customer Intelligence Studio contains a security vulnerability with attachments.

Potential Impact: An attacker might be able to upload malicious files by using the attachments functionality in SAS^® Marketing Automation, SAS^® Marketing Optimization, and SAS^® Digital Marketing.

Click the Hot Fix tab in this note to access the hot fix for this issue.

If you want to disable the attachments functionality after you apply the hot fix, add the following server property to the setenv.sh or wrapper.conf file (as appropriate) that is used to start the server where SAS Customer Intelligence Studio is located (typically, SASServer6_1).

Also, prevent users from adding attachments within SAS Customer Intelligence Studio by setting the <turnAttachmentsOff>true</turnAttachmentsOff> property in the config.xml file, as as detailed in the section "Prevent Users from Adding Attachments" section of "Chapter 2: Administration" in the SAS Marketing Automation: Administrators Guide for your release.

Be aware that there is currently an unintended consequence of adding this new server property, as detailed in SAS Note 63298, "SAS^® You receive an HTTP 500 error in SAS Customer Intelligence Studio when you try to create a PDF document for a campaign."

Operating System and Release Information

A fix for this issue for SAS Marketing Automation 6.5 is available at:

A fix for this issue for SAS Marketing Automation 6.4 is available at: