CVE-2024-48735

Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized users.

Score

CVSS 3.1 7.7 High

Status

Deferred - cve@mitre.org

Published

2024-10-30

Last modified

2026-07-05

Weaknesses

CWE-22

Affected products

• Studio (Sas)

References

• https://github.com/ACN-CVEs/CVE-2024-48735/blob/67e86e12393650e1df16c845ceff487d016f31f0/LFI.pdf