CVE-2019-14678

Published: Nov 14, 2019Modified: Nov 21, 2024

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: NVD

Description

SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. This vulnerability also affects the XMLV2 LIBNAME engine when the AUTOMAP option is used.

Affected (2)

Products: Sas: Xml Mapper, Base Sas

Sas

2 products

Xml Mapper

Base Sas

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sas Xml Mapper	Version 9.45

Configuration B

1 vulnerable · 19 platform

Vulnerable Software	Affected Versions
Sas Base Sas	Version 9.4 ts1m6

Running on/with	Platform Versions
Hp Hp Ux	All versions
Ibm Aix	All versions
Ibm Z/os	All versions
Linux Linux Kernel	All versions
Microsoft Windows	All versions
Microsoft Windows 10	All versions
Microsoft Windows 7	All versions
Microsoft Windows 7	All versions
Microsoft Windows 7	All versions
Microsoft Windows 7	All versions
Microsoft Windows 8	All versions
Microsoft Windows 8	All versions
Microsoft Windows 8.1	All versions
Microsoft Windows Server 2012	All versions
Microsoft Windows Server 2012	All versions
Microsoft Windows Server 2012	Version r2
Microsoft Windows Server 2016	All versions
Microsoft Windows Server 2019	All versions
Oracle Solaris	All versions