CVE-2019-14678

CRITICAL 10.0CVE-2019-14678 · Published 14/11/2019 · updated 17/06/2026

In short

CVE-2019-14678 is a CRITICAL (CVSS 10.0) vulnerability affecting base sas (sas), xml mapper (sas).
Chance of exploitation in the next 30 days (EPSS): 3.0%, higher than 87.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
base sas sas	`= 9.4`	No fix yet
xml mapper sas	`= 9.45`	No fix yet

Description

SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. This vulnerability also affects the XMLV2 LIBNAME engine when the AUTOMAP option is used.

References

support.sas.com/kb/64/719.html · Vendor Advisory
DrunkenShells/Disclosures · Exploit

More vulnerabilities in base sas

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free