Severity: Medium

Description: SAS Management Console contains an XML External Entity (XXE) processing vulnerability in the Add Resource Template capability.

Potential Impact: An attacker might gain unauthorized access to files or might embed malicious content. See XML External Entity (XXE) Processing for further information.

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

A fix for this issue for Base SAS JAR Files 9.4_M6 is available at:

A fix for this issue for SAS Grid Manager Plug-ins for SAS Management Console 9.4_M6 is available at:

A fix for this issue for SAS Job Flow Scheduler Orchestrator 9.46 is available at:

A fix for this issue for SAS Job Flow Scheduler Trigger 9.46 is available at:

A fix for this issue for SAS Management Console 9.4_M6 is available at:

A fix for this issue for Data Integration Studio 4.904 is available at:

A fix for this issue for SAS Middle Tier 9.4_M6 is available at:

A fix for this issue for Data Integration Studio 4.903 is available at:

A fix for this issue for SAS Grid Manager Plug-ins for SAS Management Console 9.4_M5 is available at:

A fix for this issue for SAS Management Console 9.4_M5 is available at:

A fix for this issue for SAS Middle Tier 9.4_M5 is available at:

A fix for this issue for SAS Flex Application Themes 4.7.2 is available at:

A fix for this issue for Data Integration Studio 4.901 is available at: