CVE-2019-14678

🗓️ 14 Nov 2019 20:59:44Reported by mitreType

SAS XML Mapper 9.45 XXE vulnerability allows various attacks, including file reading, file exfiltration, SSRF, and potential DoS. Also affects XMLV2 LIBNAME engine with AUTOMAP option

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2019-14678	14 Feb 202414:27	–	circl
CNVD	SAS Institute SAS XML Mapper XML External Entity (XXE) Vulnerability	19 Nov 201900:00	–	cnvd
Cvelist	CVE-2019-14678	14 Nov 201920:59	–	cvelist
EUVD	EUVD-2019-5829	7 Oct 202500:30	–	euvd
NVD	CVE-2019-14678	14 Nov 201921:15	–	nvd
OSV	CVE-2019-14678	14 Nov 201921:15	–	osv
Prion	Xxe	14 Nov 201921:15	–	prion
RedhatCVE	CVE-2019-14678	22 May 202510:31	–	redhatcve

NVD

Node

sas xml_mapperMatch9.45

Node

sas base_sasMatch9.4ts1m6

AND

hp hp-uxMatch-

ibm aixMatch-

ibm z/osMatch-

linux linux_kernelMatch-

microsoft windowsMatch-x64

microsoft windows_10Match-

microsoft windows_7Match--enterprise

microsoft windows_7Match--home_premium

microsoft windows_7Match--professional

microsoft windows_7Match--ultimate

microsoft windows_8Match-enterprise

microsoft windows_8Match-pro

microsoft windows_8.1Match-pro

microsoft windows_server_2012Match-datacenter

microsoft windows_server_2012Match-standard

microsoft windows_server_2012Matchr2datacenter

microsoft windows_server_2016Match-

microsoft windows_server_2019Match-

oracle solarisMatch-x64

Source	Link
github	www.github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14678-Unsafe%20XML%20Parsing-SAS%20XML%20Mapper
support	www.support.sas.com/kb/64/719.html

21 Nov 2024 04:27Current

9.3High risk

Vulners AI Score9.3

CVSS 27.5

CVSS 3.110

EPSS0.00798

CWE-611