Severity: Critical 

Description: SAS Platform Web Services contains an Apache component that is affected by the following known vulnerabilities: 

• CVE-2022-46364  
• CVE-2022-46363
• CVE-2021-40690

Potential Impact:

These vulnerabilities might allow an attacker to do the following:

• perform SSRF style attacks on web services that take at least one parameter of any type
• perform remote directory listings or code exfiltration 
• extract any local XML files

Refer to the CVE records listed in the previous section for additional details.

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

A fix for this issue for Platform Web Services for SAS 1.8 is available at:

A fix for this issue for SAS Grid Env Manager and Platform Web services 1.8 1.8 is available at: