CVE-2024-48734

Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users.

Score

CVSS 3.1 8.8 High

Status

Deferred - cve@mitre.org

Published

2024-10-30

Last modified

2026-07-05

Weaknesses

CWE-434

Affected products

• Studio (Sas)

References

• https://github.com/ACN-CVEs/CVE-2024-48734/blob/d59cca7b03bce3a516035d1a0f488d67c3d10ae6/Unrestricted%20file%20upload.p…