CVE-2024-48735

HIGH EPSS 57.2%

Published Oct 30, 20241y ago · Modified Jun 17, 20262w ago

7.7 CVSS 3.1

High

Published Oct 30, 2024 1y ago

Last Modified Jun 17, 2026 2w ago

Description

Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized users.

CVSS Details

Base Score

7.7

Exploitability

3.1

Impact

4.0

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Changed

Confidentiality High

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

57.2% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

References 2

sas.com http://sas.com
github.com https://github.com/ACN-CVEs/CVE-2024-48735/blob/67e86e12393650e1df16c845ceff487d016f31f0/LFI.pdf

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.