CVE-2019-14678

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-11-14 · updated 2026-06-17
Weakness: CWE-611

Description

SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. This vulnerability also affects the XMLV2 LIBNAME engine when the AUTOMAP option is used.

Affected products

Sas Base Sas: 9.4-ts1m6
Sas Xml Mapper: 9.45

References

http://support.sas.com/kb/64/719.html
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14678-Unsafe%20XML%20Parsing-SAS%20XML%20Mapper
http://support.sas.com/kb/64/719.html
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14678-Unsafe%20XML%20Parsing-SAS%20XML%20Mapper

Get alerted when CVE-2019-14678 or the next vulnerability affects your stack