Back to CVE Browser

CVE-2019-14678

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.1870%

EPSS Percentile27.04th

PublishedNov 14, 2019

Last ModifiedNov 21, 2024

Vulnerability Description

SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. This vulnerability also affects the XMLV2 LIBNAME engine when the AUTOMAP option is used.

Affected Platforms (CPE)

📦

Sas

Xml Mapper

= 9.45

📦

Sas

Base Sas

= 9.4

References & Advisories

🔗 http://support.sas.com/kb/64/719.html

🔗 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14678-Unsafe%20XML%20Parsing-SAS%20XML%20Mapper

🔗 http://support.sas.com/kb/64/719.html

🔗 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14678-Unsafe%20XML%20Parsing-SAS%20XML%20Mapper

Related Vulnerabilities

CVE-2019-101727.5

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-...

CVE-2007-15305.0

The LLTD Mapper in Microsoft Windows Vista does not properly gather responses to EMIT packets, which allows remote attackers to ca...

CVE-2019-390510.0

Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.

CVE-2019-002010.0

Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full contr...