CVE-2019-14678
10.0
CRITICAL · CVSS 3.1 · EPSS 3% (pctl 87)
In your normal cycle
Critical by CVSS (10), but no sign of active exploitation.
Description
SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. This vulnerability also affects the XMLV2 LIBNAME engine when the AUTOMAP option is used.
Scoring
| CVSS | 10.0 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 2.95% — more likely to be exploited than 87% of all CVEs |
| Weakness | CWE-611 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2019-11-14 |
| Last modified | 2026-06-17 |
Affected (15)
| Vendor | Product |
|---|---|
| hp | hp-ux |
| ibm | aix |
| ibm | z\/os |
| linux | linux kernel |
| microsoft | windows |
| microsoft | windows 10 |
| microsoft | windows 7 |
| microsoft | windows 8 |
| microsoft | windows 8.1 |
| microsoft | windows server 2012 |
| microsoft | windows server 2016 |
| microsoft | windows server 2019 |
| oracle | solaris |
| sas | base sas |
| sas | xml mapper |
References
- http://support.sas.com/kb/64/719.html
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14678-Unsafe%20XML%20Parsing-SAS%20XML%20Mapper
- http://support.sas.com/kb/64/719.html
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14678-Unsafe%20XML%20Parsing-SAS%20XML%20Mapper
→ the Explorer · watch your stack · NVD