PT-2019-13775 · Sas · Sas Xml Mapper

Publicado 2019-11-14 · Atualizado 2019-11-22 · CVE-2019-14678

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAS XML Mapper version 9.45

Description The issue is an XML External Entity (XXE) vulnerability. This can be exploited by malicious attackers in various ways, including Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. The XMLV2 LIBNAME engine is also affected when the AUTOMAP option is used.

Recommendations For SAS XML Mapper version 9.45, consider disabling the AUTOMAP option in the XMLV2 LIBNAME engine as a temporary workaround to minimize the risk of exploitation. Restrict access to sensitive files and directories to prevent potential Local File Reading and Out Of Band File Exfiltration attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2019-14678

Produtos afetados

Sas Xml Mapper

Referências · 4

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14678-Unsafe%20XML%20Parsing-SAS%20XML%20Mapper · Exploit
• http://support.sas.com/kb/64/719.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-14678 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14678 · Nota de Segurança