CVE-2019-7442
critical · 9.8An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remote attackers to read arbitrary files or potentially bypass authentication via a crafted DTD in the SAML authentication system.
9.8
CVSS
40.0%
EPSS (exploit prob.)
99th
EPSS percentile
2019-05-08
Published
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| cyberark | enterprise_password_vault | <= 10.7 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/152801/CyberArk-Enterprise-Password-Vault-10.7-XML-External-Entity-Injection.html
- https://www.octority.com/2019/05/07/cyberark-enterprise-password-vault-xml-external-entity-xxe-injection/
- http://packetstormsecurity.com/files/152801/CyberArk-Enterprise-Password-Vault-10.7-XML-External-Entity-Injection.html
- https://www.octority.com/2019/05/07/cyberark-enterprise-password-vault-xml-external-entity-xxe-injection/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2019-7442