CVE-2019-14678

SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. This vulnerability also affects the XMLV2 LIBNAME engine when the AUTOMAP option is used.

• CWE-611

• http://support.sas.com/kb/64/719.htmlVendor Advisory
• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14678-Unsafe%20XML%20Parsing-SAS%20XML%20MapperExploit, Third Party Advisory
• http://support.sas.com/kb/64/719.htmlVendor Advisory
• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14678-Unsafe%20XML%20Parsing-SAS%20XML%20MapperExploit, Third Party Advisory

Published

Nov 14, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14668Firefly III 4.7.17.3 is vulnerable to stored XSS due to the …
• CVE-2019-14669Firefly III 4.7.17.3 is vulnerable to stored XSS due to the …
• CVE-2019-1467An information disclosure vulnerability exists when the Wind…6.5
• CVE-2019-14670Firefly III 4.7.17.3 is vulnerable to stored XSS due to the …
• CVE-2019-14671Firefly III 4.7.17.3 is vulnerable to local file enumeration…
• CVE-2019-14672Firefly III 4.7.17.5 is vulnerable to stored XSS due to the …
• CVE-2019-14679core/views/arprice_import_export.php in the ARPrice Lite plu…
• CVE-2019-1468A remote code execution vulnerability exists when the Window…8.8
• CVE-2019-14680The admin-renamer-extended (aka Admin renamer extended) plug…5.7
• CVE-2019-14681The Deny All Firewall plugin before 1.1.7 for WordPress allo…
• CVE-2019-14682The acf-better-search (aka ACF: Better Search) plugin before…
• CVE-2019-14683The codection "Import users from CSV with meta" plugin befor…5.7