CVE-2019-7442

An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remote attackers to read arbitrary files or potentially bypass authentication via a crafted DTD in the SAML authentication system.

CVSS v3.0

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

40.01% chance of exploitation in the next 30 days, 99th percentile

Published

2019-05-08

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://www.octority.com/2019/05/07/cyberark-enterprise-password-vault-xml-external-entit…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/46828

References

• CVE Record
• NVD entry

Related

• CVE-2019-7441
• CVE-2019-7481
• CVE-2019-7440
• CVE-2019-7482
• CVE-2019-7439
• CVE-2019-7488