Reference Name: Apache Tomcat Vulnerability CVE-2020-9484
Severity: Informational
Status: No action by customers is required.
History
- 06-15-2020 – Assessment completed
Impact
SAS® software is not exposed to the Apache Tomcat vulnerability CVE-2020-9484.
Description
Apache Tomcat has known remote code execution vulnerabilities resulting from a flaw that exploits the Tomcat PersistenceManager and FileStore components.
Solution
The default SAS® Web Application Server configuration of Apache Tomcat does not enable or use PersistenceManager or FileStore. Therefore, the default configuration is not vulnerable to CVE-2020-9484.