CVE-2007-6763

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-31 · updated 2026-06-16
Weakness: CWE-20

Description

SAS Drug Development (SDD) before 32DRG02 mishandles logout actions, which allows a user (who was previously logged in) to access resources by pressing a back or forward button in a web browser.

Affected products

Sas Drug Development: before 32drg02 — fixed in 32drg02

How to fix

Upgrade to a fixed version: Sas Drug Development 32drg02. Check the vendor advisory for mitigations.

References

http://ftp.sas.com/techsup/download/hotfix/drugdev/32drg02/SDD_Release_Notes_32DRG02.pdf
http://ftp.sas.com/techsup/download/hotfix/drugdev/32drg02/SDD_Release_Notes_32DRG02.pdf

Get alerted when CVE-2007-6763 or the next vulnerability affects your stack