SAS Statement Regarding Apache Struts 2  Vulnerabilities (CVE-2019-0230 and CVE-2019-0233)

Reference Name: Apache Struts 2 Vulnerabilities (CVE-2019-0230 and CVE-2019-0233)
Severity: Informational
Status: No action by customers is required

History

10-5-2020 – Assessment completed

Impact

Customer deployments of SAS^® are not vulnerable to CVE-2019-0230 and CVE-2019-0233.

Description

Apache Struts 2 is affected by the vulnerabilities described in CVE-2019-0230 and CVE-2019-0233.

Solution

The custom version of Apache Struts that is managed and delivered by SAS is not vulnerable to this exploitation because it does not include the particular features that expose these vulnerabilities.